---
name: implement-yoursafe-id
description: Implements Yoursafe ID sign-in and verified claims with OpenID Connect. Use when adding Yoursafe ID login, token exchange, claim reads, or alias-token lookups to an application.
title: Yoursafe ID
summary: Sign-in and verified claims. Follow the OIDC guides, and keep the secret and token checks on the server.
slug: yoursafe-id
order: 1
---

# Implement Yoursafe ID

Yoursafe ID is OpenID Connect. The live discovery document is the source for endpoint URLs. If this skill and a product page disagree, follow the product page.

## Read first

1. [Getting Started](/en/id-integration-getting-started)
2. [Integration](/en/id-integration)
3. [Endpoint Reference](/en/id-oidc-endpoints)
4. [Claims Glossary](/en/id-claims-glossary) for the scopes you request
5. [Alias Token Queries](/en/alias-token-queries) only when you look up a public alias

## Implement in this order

1. Register the client and the exact redirect URI.
2. On each sign-in, create `state` and `nonce` on the server and store them before the redirect.
3. Send the user to the authorization endpoint from discovery.
4. On the callback, reject the request unless `state` matches, then exchange the code on the server.
5. Validate the `id_token` signature, issuer, audience, expiry, and `nonce` before creating a session.
6. Call userinfo with the access token, and only for claims the scopes allow.

## Credentials

- Client id and client secret from the Yoursafe ID client registration.
- The secret stays on the server. The browser never sees it.
- Discovery host is `accounts.yoursafe.com`. Read `/.well-known/openid-configuration` and use those URLs.

## Traps

- The redirect URI has to match the registered value exactly. A trailing slash or a different port is a different URI.
- A callback with a `state` or `nonce` you did not store is not a login you started.
- Token exchange and refresh run on the server. Use the client authentication method discovery advertises, `client_secret_basic` or `client_secret_post`.
- Alias lookups are a different host. Query `https://<aliastoken>.yoursafe.id/?json=1`, not `accounts.yoursafe.com`.

## Done when

A user can sign in, the callback rejects a mismatched `state`, the `id_token` is verified before a session exists, and claims come from userinfo or the token.