Sign in with Okay ID

Okay ID is a standard OpenID Connect provider. If your framework can do "Sign in with Google", it can do Okay ID: give it the issuer, a client ID and (for server apps) a secret.

1. Register your app

Create an app in the developer console. Choose On a server for apps with a backend (you get a client secret) or In the browser or on a device for SPAs, mobile, desktop and CLI apps (no secret, PKCE required). Add your redirect URIs exactly.

2. Point your library at the issuer

https://okayid.com

Discovery lives at /.well-known/openid-configuration. Keys are at /jwks.json.

3. The flow

Authorization code flow, with PKCE (S256) required for public apps and recommended for everyone.

GET https://okayid.com/authorize
  ?response_type=code
  &client_id=oki_…
  &redirect_uri=https://app.example.com/callback
  &scope=openid profile email
  &state=…  &nonce=…
  &code_challenge=…  &code_challenge_method=S256

Okay ID signs the person in (email code or passkey), asks once for consent, and redirects back with ?code=…&state=…&iss=…. Swap the code within 60 seconds:

POST https://okayid.com/token
Authorization: Basic base64(client_id:client_secret)
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=okc_…&redirect_uri=…&code_verifier=…

You get back an id_token (RS256 JWT), an access_token (1 hour) and, if you asked for offline_access, a refresh_token (30 days, rotates on every use; reusing an old one revokes the chain).

Scopes and claims

Scope	Claims
`openid`	`sub` (stable, never changes), `auth_time`, `amr`, `sid`
`profile`	`name`, `given_name`, `family_name`, `updated_at`
`email`	`email`, `email_verified` (always verified)
`offline_access`	A refresh token

Use sub as the user key, not the email.

Endpoints

Authorize	`https://okayid.com/authorize`
Token	`https://okayid.com/token`
UserInfo	`https://okayid.com/userinfo`
JWKS	`https://okayid.com/jwks.json`
Revoke	`https://okayid.com/revoke` (RFC 7009)
Introspect	`https://okayid.com/introspect` (RFC 7662)
Sign out	`https://okayid.com/logout?id_token_hint=…&post_logout_redirect_uri=…&state=…`

Prompts

prompt=none for silent SSO checks (returns login_required or consent_required), prompt=login or max_age to force a fresh sign-in, prompt=consent to ask again, login_hint to prefill the email. response_mode=form_post is supported.

Examples

Auth.js / NextAuth

{
  id: "okayid", name: "Okay ID", type: "oidc",
  issuer: "https://okayid.com",
  clientId: process.env.OKAYID_CLIENT_ID,
  clientSecret: process.env.OKAYID_CLIENT_SECRET,
}

openid-client (Node)

import * as client from "openid-client";
const config = await client.discovery(new URL("https://okayid.com"), CLIENT_ID, CLIENT_SECRET);

Cloudflare Access, Supabase, Auth0, Okta, Clerk…

Add a generic OpenID Connect provider with the issuer above. Redirect URI is whatever that service tells you.

Single sign-on across apps

Once someone signs in to Okay ID, every other app that sends them to /authorize gets them back instantly (no second sign-in, consent asked once per app). Sign-out from your app with the /logout endpoint ends their Okay ID session too.