How do I register my first application and go live with UIID sign-in?

Step 1 — Register the application. POST /api/v1/applications with a name and a redirect_uri returns your client_id and client_secret. Access can be revoked at any time with DELETE /api/v1/applications/{id}.

Step 2 — Point your OIDC library at discovery. GET /.well-known/openid-configuration and GET /.well-known/jwks.json let standard libraries such as NextAuth or Passport configure themselves and verify ID token signatures, instead of hard-coding endpoints.

Step 3 — Start the login. Redirect to GET /oauth/authorize with your client_id, redirect_uri, response_type=code and the scopes you need — for example openid profile email alias:read:public.

Step 4 — Exchange the code. POST /oauth/token with grant_type=authorization_code returns an access_token, a token_type of Bearer, an expires_in (typically 3600 seconds), a refresh_token and the granted scope.

Step 5 — Read the claims. GET /oauth/userinfo with a bearer header returns sub (the DID), name, email, email_verified and uiid_core_id.

Step 6 — Handle refresh before you ship. Access tokens are short-lived by design; call POST /oauth/token with grant_type=refresh_token.

What you no longer build: registration, password storage, password resets and login.

Reference: uiid.linkspreed.com/api-docs · Examples: the UIID Cookbook on Github.