Overview
Use the hosted authorization flow for user sign-in. Use client credentials only for application-owned access to a configured protected resource. Do not collect Raha Account passwords inside client applications.
Endpoint origins
Raha Account deployments may use separate issuer and API origins:
ISSUER: discovery, hosted authorization, and account pages.API_BASE:/api/oauth2protocol endpoints and/api/v1resource APIs.
Always read the actual URLs from GET {ISSUER}/.well-known/openid-configuration.
Choose a flow
| Need | Flow |
|---|---|
| Sign a user into a web app, SPA, or mobile app | Authorization Code + S256 PKCE |
| Keep a user signed in with explicit offline consent | Refresh token with offline_access |
| Sign in a TV, CLI, or input-constrained device | Device Authorization Grant |
| Access assigned users from a backend service | Client Credentials with the account-directory resource |
| Change the active profile represented by a user token | Token exchange with a requested profile ID |
Core scopes
openidenables OpenID Connect and is required for UserInfo.profile,email, andphonerelease the corresponding approved claims.offline_accessrequests refresh-token access.users:read,users:read:email, andusers:read:phoneare application scopes for the account directory.
Next steps
- Follow the web application quickstart.
- Review authentication and the OAuth endpoint reference.
- Match the hosted UI with authorization UI preferences.
- Use device authorization for devices without a convenient browser.