Guide
Treat this host as the identity provider: your app only needs a login link, a callback route, and token verification. No password storage in consumer services.
For interactive OAuth-style experiments, use OAuth Playground; the steps below focus on the /login redirect contract.
Send the browser to /login with redirectUrl (absolute or same-origin path) and optional state.
User enters password; TOTP if configured; or WebAuthn-only when enabled. Remember me changes JWT lifetime.
Browser lands on redirectUrl with token=… and the same state you sent (if any).
Your backend verifies the JWT (shared secret) or calls /api/auth/verify, then issues your own session.
Always URL-encode redirectUrl. Example pattern:
Use the same JWT_SECRET as this deployment. Verify authenticated, expiry, and optionally iss/sub to match your policy.
POST JSON { token, audience?, scope? } to /api/auth/verify. The route checks Origin against your redirect allowlist, requires HTTPS for browser calls, and returns the standard envelope: code === 0 with data shaped like an OAuth token response (access_token, token_type, expires_in, user, optional claims).
JWT_SECRET in the consumer; this host performs verificationReplace YOUR_AUTH_HOST with your deployed auth base (no trailing slash). Keep state server-side or in sessionStorage only for the duration of the redirect.
Start login
Callback route