Connect an application

Authara is a standard OpenID Connect / OAuth 2.1 provider, so any spec-compliant client works. This page uses the OIDC SDKs Authara ships with.

1. Discovery

Point your SDK at the issuer and it self-configures from the discovery document:

GET {ENDPOINT}/oidc/.well-known/openid-configuration

It advertises the authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, end_session_endpoint, supported scopes, and PKCE methods.

2. Register the application

Admin console → Applications → create one and pick the type:

• Single-page app / Native — public client, PKCE (S256) required, no secret.
• Traditional web — confidential client with a secret.
• Machine-to-machine — no user; uses client-credentials (see Management API).

Set the redirect URIs (post-login callback) and post-logout redirect URIs. You receive a client_id (and a secret for confidential apps).

3. Sign a user in

Authorization-code flow with PKCE:

import LogtoClient from '@logto/browser'; // Authara is OIDC-compatible; standard OIDC SDKs work as-is

const client = new LogtoClient({
  endpoint: 'https://sso.example.com',
  appId: '<client_id>',
});

// Redirect to the Authara sign-in experience:
await client.signIn('https://your-app.example.com/callback');

// On your callback route:
await client.handleSignInCallback(window.location.href);

// Later:
const isAuthed = await client.isAuthenticated();
const claims = await client.getIdTokenClaims();
const token = await client.getAccessToken('https://api.example.com'); // for a protected API

Any OIDC library (oidc-client-ts, openid-client, a mobile AppAuth SDK, …) integrates the same way — pass the issuer and client_id.

Per-application branding

For the sign-in screen to show this app's logo/colors/background instead of the tenant default, the authorize request must carry the app context — the SDK does this automatically by sending client_id. See Application branding.

4. Protect your API

1. Register the API as a resource (see Management API & RBAC) with a unique resource indicator (the token audience).
2. On each request to your API:

1. Read `Authorization: Bearer <token>`.
2. Verify the JWT against {ENDPOINT}/oidc/jwks.
3. Assert  iss == {ENDPOINT}/oidc ,  aud == "<your resource indicator>" ,  exp not passed.
4. Assert the required scope is present.

Apps request a token for your resource with getAccessToken('<resource-indicator>').

Next

• Sessions & tokens
• Multi-factor authentication