Guide
Optional hardening: instead of putting a raw JWT in the browser query string, the client generates an ephemeral ECDH key pair and sends the public key with login. The server derives a shared secret, encrypts the session token payload, and returns ciphertext the browser decrypts locally—reducing exposure to shoulder-surfing, referrer leaks, and intermediate proxies that log full URLs.
Standard redirect flow without ECDH remains supported. When you are ready to exercise the full OAuth-shaped path, use OAuth Playground alongside the /ecdh key tool.
/login with ECDH enabled)ECDH_SERVER_PRIVATE_KEY to the server private PEM. In env files, keep newlines escaped or quoted so the value parses as one line—your platform's secret UI usually handles multiline PEM cleanly.ECDH_SERVER_PUBLIC_KEY for local debugging only; production browsers should fetch the current public key from /api/oauth/public-key so rotation can be centralizedKey rotation and overlap windows are described under Advanced in Environment variables when you enable KV-backed rotation.