Sign in with Caliplaces

1. Register an app with your Caliplaces account and add the redirect URIs your app uses.
2. Point your OIDC library at the issuer below with your client id (and secret, for web apps).
3. Users see the Caliplaces sign-in page, sign in with Google, Apple or email, approve your app on a consent screen (only the first time), and come back to your redirect URI with an authorization code.
4. Exchange the code for tokens and read the profile from the ID token or the UserInfo endpoint.

Most libraries only need the issuer and discover everything else from the discovery document.

Every app uses the authorization code flow with refresh tokens. The implicit flow is not available.

These are the only scopes third-party apps may request. Any other scope, including every urn:zitadel:* scope, ends the sign-in with invalid_scope. A user who declines the consent screen comes back with access_denied.

Register a web app with the redirect URI https://your-app.com/api/auth/callback/caliplaces, then:

import NextAuth from 'next-auth';

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    {
      id: 'caliplaces',
      name: 'Caliplaces',
      type: 'oidc',
      issuer: 'https://auth.caliplaces.com',
      clientId: process.env.CALIPLACES_CLIENT_ID,
      clientSecret: process.env.CALIPLACES_CLIENT_SECRET,
      authorization: { params: { scope: 'openid profile email' } },
      checks: ['pkce', 'state'],
    },
  ],
});

Send the user to the authorization endpoint:

GET https://auth.caliplaces.com/oauth/v2/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fyour-app.com%2Fcallback
  &response_type=code
  &scope=openid%20profile%20email
  &state=RANDOM_STATE
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256

Exchange the code on your server (public clients send client_id instead of Basic auth):

curl -X POST https://auth.caliplaces.com/oauth/v2/token \
  -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET \
  -d grant_type=authorization_code \
  -d code=THE_CODE \
  -d redirect_uri=https://your-app.com/callback \
  -d code_verifier=THE_VERIFIER

Then read the profile:

curl https://auth.caliplaces.com/oidc/v1/userinfo \
  -H "Authorization: Bearer ACCESS_TOKEN"

• Create a separate app for local development, like "My App (dev)", with your http://localhost redirect URIs, and keep localhost out of your production app.
• Identify users by sub, never by email. Emails can change; sub does not.
• Only trust email when email_verified is true.
• Always send state, and a nonce when you use the ID token. Use PKCE even for web apps.
• Redirect URIs match exactly: https on any host, http only on localhost, no wildcards.
• Tokens issued to your app identify the user to you. They are not accepted by the Caliplaces API.
• Keep the client secret on your server. If it leaks, rotate it from your app settings.

Label the button Sign in with Caliplaces or Continue with Caliplaces, and do not suggest that your app is made or endorsed by Caliplaces. Apps that mislead users or misuse their data are removed.