Guides

Continue with SeleID: register an app

Overview · React Native and Expo · Android · iOS · Register an app · API reference · Errors and security · Changelog

Coming soon @seletech/seleid-client is not on npm yet. These pages describe version 0.1.0 so you can plan an integration. See the roadmap.

Coming soon Sign-in for outside apps is built and opens with Continue with SeleID. Until then these calls answer 404.

1. Register a sandbox app

Signed in to the Developer Console, call the registration API. Sandbox apps may use http://localhost redirect URIs; every other redirect URI must be HTTPS. Production apps need review and cannot be self-registered yet.

Request

curl -X POST https://auth.seleid.dev/v1/dev-apps   -H 'content-type: application/json' -H 'origin: https://developers.seleid.dev'   --cookie "$SELEID_SESSION"   -d '{"name":"My app","redirect_uris":["https://example.com/auth/callback"],"scopes":["openid"],"client_type":"confidential"}'

Response

{ "client_id": "sandbox_cli_...", "client_secret": "...", "client_type": "confidential", "secret_shown_once": true }

The secret is shown once and stored only as a hash. Use "client_type":"public" for mobile and single-page apps: they get no secret and rely on PKCE.

2. Send people to authorize

https://auth.seleid.dev/authorize?client_id=sandbox_cli_...&redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fcallback
  &response_type=code&scope=openid&state=RANDOM&nonce=RANDOM_16_CHARS_MIN
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER&code_challenge_method=S256

People sign in, then see a consent screen naming your app and the permissions it asks for. They return to your redirect_uri with code and state, or error=access_denied.

3. Exchange the code

client_secret_basic

curl -X POST https://auth.seleid.dev/oauth/token   -u "$CLIENT_ID:$CLIENT_SECRET"   -d grant_type=authorization_code -d code="$CODE"   -d redirect_uri=https://example.com/auth/callback -d code_verifier="$VERIFIER"

Response

{ "access_token": "...", "token_type": "Bearer", "expires_in": 3600, "id_token": "...", "refresh_token": "...", "scope": "openid" }

Confidential apps may send client_secret in the body instead (client_secret_post). Public apps send client_id and no secret. Refresh tokens rotate: store the new one before using it.

4. Use and revoke the token

curl https://auth.seleid.dev/oauth/userinfo -H "authorization: Bearer $ACCESS_TOKEN"        # { "sub": "..." }
curl https://auth.seleid.dev/v1/session/context -H "authorization: Bearer $ACCESS_TOKEN"   # online session check
curl -X POST https://auth.seleid.dev/oauth/revoke -u "$CLIENT_ID:$CLIENT_SECRET" -d token="$ACCESS_TOKEN"

A token stops working when the person revokes access or a security change on their account happens. An app can only revoke its own tokens.

5. Rotate the secret, add test users

curl -X POST https://auth.seleid.dev/v1/dev-apps/$CLIENT_ID/rotate-secret -H 'origin: https://developers.seleid.dev' --cookie "$SELEID_SESSION"
curl -X POST https://auth.seleid.dev/v1/dev-apps/$CLIENT_ID/sandbox-accounts -H 'content-type: application/json' -H 'origin: https://developers.seleid.dev' --cookie "$SELEID_SESSION" -d '{"label":"Tester"}'

The old secret stops working immediately. Test users belong to one sandbox app; on the consent screen you can choose to sign in as one.

Endpoints