sooauthHome

Connect your app (OIDC)

sooauth speaks standard OpenID Connect. Your app redirects users to authorize, exchanges a code for tokens, and reads userinfo — same as Auth0 or Google.

Discovery

Fetch metadata once at startup:

https://auth.sooauth.com/.well-known/openid-configuration

OAuth client

In admin, each app is an OAuth client with:

  • · client_id — public identifier
  • · redirect_uris — exact callback URLs (must match)
  • · PKCE required for public clients (SPAs, mobile)

soobserver example

In soobserver .env:

SOOAUTH_ISSUER=https://auth.sooauth.com
SOOAUTH_CLIENT_ID=soobserver
SOOAUTH_REDIRECT_URI=https://app.sooobserver.com/api/auth/callback/oidc

Add the production redirect URI to the soobserver client in admin. Dev uses localhost callback from the seed migration.

Authorization flow

  1. 1. App sends user to /oauth/authorize with client_id, redirect_uri, code_challenge (PKCE)
  2. 2. User signs in on hosted pages if needed
  3. 3. Browser returns to your callback with code
  4. 4. Backend POSTs to /oauth/token with code + verifier
  5. 5. Use access token on /oauth/userinfo or validate JWT via JWKS

JS SDK (optional)

Monorepo package @sooauth/sdk-js wraps redirect + callback + session middleware for Next.js.

import { createSooauthClient } from "@sooauth/sdk-js";

const client = createSooauthClient({
  issuer: "https://auth.sooauth.com",
  clientId: "your-client-id",
  redirectUri: "https://yourapp.com/callback",
});