Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Environments and endpoints

The two origins a frontend works with, and where each API lives.

A frontend talks to two origins. appsolut gives you both, with the project's publishable key, for each environment you work in (for example a test environment and production):

  • <auth>: the Auth API of the Studio's project, https://<project API host>/auth/v1. It runs the OAuth 2.1 server: authorization, tokens and the keys to verify them.
  • <studio>: the Studio's origin. It serves the sign-in surface under /oauth/* and the Members API under /api/v1.

An external register is the other way round: the Studio calls the base URL your register exposes.

Where each API lives

WhatEndpointCalled by
OIDC discoveryGET <auth>/.well-known/openid-configurationyour backend, once
AuthorizeGET <auth>/oauth/authorizethe browser, redirected there by your app
Sign-in surface<studio>/oauth/authorize?authorization_id=…the browser, redirected there by <auth>; never call it yourself
TokenPOST <auth>/oauth/tokenyour backend
UserInfoGET <auth>/oauth/userinfoyour backend; it answers only sub, so you rarely need it
JWKSGET <auth>/.well-known/jwks.jsonyour backend, to verify tokens
Sign-out page<studio>/oauth/sign-out?client_id=<your client ID>the browser
Members API<studio>/api/v1/members/...your backend, with its frontend key
appsolut register APIyour register's base URLthe Studio

On calls from your backend to <auth>, send the publishable key as the apikey header.

Local development

Redirect URIs and the start URL may use http://localhost or http://127.0.0.1 with any port, so a frontend running on your machine can sign in against a test environment. Everything else needs https.

Server to server only

The Members API answers no CORS, and the tokens of Login with appsolut belong on your server: never hand the access or refresh token, the client secret or a frontend key to the browser.