Implement Yoursafe ID

Yoursafe ID is OpenID Connect. The live discovery document is the source for endpoint URLs. If this skill and a product page disagree, follow the product page.

Read first

1. Getting Started
2. Integration
3. Endpoint Reference
4. Claims Glossary for the scopes you request
5. Alias Token Queries only when you look up a public alias

Implement in this order

1. Register the client and the exact redirect URI.
2. On each sign-in, create state and nonce on the server and store them before the redirect.
3. Send the user to the authorization endpoint from discovery.
4. On the callback, reject the request unless state matches, then exchange the code on the server.
5. Validate the id_token signature, issuer, audience, expiry, and nonce before creating a session.
6. Call userinfo with the access token, and only for claims the scopes allow.

Credentials

• Client id and client secret from the Yoursafe ID client registration.
• The secret stays on the server. The browser never sees it.
• Discovery host is accounts.yoursafe.com. Read /.well-known/openid-configuration and use those URLs.

Traps

• The redirect URI has to match the registered value exactly. A trailing slash or a different port is a different URI.
• A callback with a state or nonce you did not store is not a login you started.
• Token exchange and refresh run on the server. Use the client authentication method discovery advertises, client_secret_basic or client_secret_post.
• Alias lookups are a different host. Query https://<aliastoken>.yoursafe.id/?json=1, not accounts.yoursafe.com.

Done when

A user can sign in, the callback rejects a mismatched state, the id_token is verified before a session exists, and claims come from userinfo or the token.