01
Discover
Read the issuer metadata and learn which endpoints and scopes are available.
OAuth playground
Sign in with Deni AI
A calm, standards-based path from consent to identity.
Build login with a provider your users already trust. This page is a working public-client example built on OAuth 2.1, OpenID Connect, and S256 PKCE.
OAuth 2.1OpenID ConnectS256 PKCE
Live OAuth playground
Public client · S256 PKCE
Use a public client with token_endpoint_auth_method set to none. Never paste a client secret here.
Register this exact URL on the OAuth client. For this page, use the current page URL.
What the client receives
openid
profile
email
The page keeps the tokens in memory only long enough to confirm the exchange, then discards them.
The flow
Four quiet steps between click and session
The protocol does the heavy lifting. Your app keeps the state, verifies the response, and decides what to do with the identity.
02
Authorize
Send the user to Deni AI with a one-time state value and S256 PKCE challenge.
03
Exchange
Trade the one-time authorization code for access and refresh tokens.
04
Identify
Call UserInfo with the access token and create the app session.
A small client surface
Keep the integration legible
The example separates browser state, authorization, token exchange, and identity lookup so each security decision is visible in code review.
const discovery = "/.well-known/openid-configuration";
const authorize = "/api/auth/oauth2/authorize";
const token = "/api/auth/oauth2/token";
const userInfo = "/api/auth/oauth2/userinfo";Protocol surface
Everything an app needs to begin
Authorization
/api/auth/oauth2/authorizeToken
/api/auth/oauth2/tokenUserInfo
/api/auth/oauth2/userinfoDiscovery
/.well-known/openid-configurationSupported scopes: openid, profile, email, and offline_access. Register a public client with an exact callback URL before starting the live flow.