Sign in with JarvisAF

Let anyone sign into your app with their JarvisAF account. Standard OAuth 2.0 with OpenID Connect and PKCE.

1. Register your app

Sign in to JarvisAF and go to /developer. Create an OAuth app with your redirect URI (e.g. https://myapp.com/oauth/callback). You'll get a client_id and one-time client_secret.

2. Endpoints

Discovery: https://jarvisaf.dev/.well-known/openid-configuration
JWKS: https://jarvisaf.dev/.well-known/jwks.json
Authorize: https://jarvisaf.dev/oauth/authorize
Token: https://jarvisaf.dev/api/public/oauth/token
Userinfo: https://jarvisaf.dev/api/public/oauth/userinfo

3. Redirect the user

https://jarvisaf.dev/oauth/authorize ?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri=https://myapp.com/oauth/callback &scope=openid email profile &state=random-csrf-string &code_challenge=BASE64URL(SHA256(code_verifier)) &code_challenge_method=S256

4. Exchange the code for tokens

POST https://jarvisaf.dev/api/public/oauth/token Content-Type: application/x-www-form-urlencoded grant_type=authorization_code &code=THE_CODE &redirect_uri=https://myapp.com/oauth/callback &client_id=YOUR_CLIENT_ID &client_secret=YOUR_CLIENT_SECRET &code_verifier=THE_VERIFIER // → { access_token, id_token, refresh_token, token_type, expires_in, scope }

5. Get user info

GET https://jarvisaf.dev/api/public/oauth/userinfo Authorization: Bearer ACCESS_TOKEN // → { sub, email, email_verified, name, picture }

6. Refreshing

POST /api/public/oauth/token grant_type=refresh_token&refresh_token=...&client_id=...&client_secret=...

Notes

  • Only authorization_code and refresh_token grants are supported.
  • PKCE (S256) is strongly recommended and required for public clients.
  • Redirect URIs are exact-match — no wildcards.
  • Access tokens are ES256-signed JWTs. Verify against the JWKS above.
  • Users can revoke your app at any time from their JarvisAF profile.