Dev Dashboard

INSERT INTO oauth_clients (id, client_id, client_name, redirect_uris, client_type, created_at)
VALUES (gen_random_uuid(), 'my-app', 'My App', '{"https://myapp.com/callback"}', 'public', now());

// Generate PKCE pair
const verifier = crypto.randomUUID() + crypto.randomUUID();
const challenge = btoa(String.fromCharCode(
  ...new Uint8Array(await crypto.subtle.digest('SHA-256',
    new TextEncoder().encode(verifier)))
)).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'');

// Store verifier for step 3
sessionStorage.setItem('pkce_verifier', verifier);

// Redirect
window.location = `https://hubid.io/oauth/authorize?` +
  new URLSearchParams({
    response_type: 'code',
    client_id:     'my-app',
    redirect_uri:  'https://myapp.com/callback',
    scope:         'openid profile email',
    state:         crypto.randomUUID(),
    code_challenge: challenge,
    code_challenge_method: 'S256',
  });

// On your /callback page, extract ?code= and exchange it:
const resp = await fetch('https://hubid.io/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  credentials: 'include',
  body: new URLSearchParams({
    grant_type:    'authorization_code',
    code:          new URLSearchParams(location.search).get('code'),
    client_id:     'my-app',
    redirect_uri:  'https://myapp.com/callback',
    code_verifier: sessionStorage.getItem('pkce_verifier'),
  }),
});

const { access_token, id_token } = await resp.json();
// access_token = RS256 JWT (15 min) — send as Bearer header
// id_token     = RS256 JWT — user profile claims
// refresh_token is set as httpOnly cookie automatically