Connect vixar.id

vixar.id adds sign-in to your website or app through OAuth 2.0 and OpenID Connect.

Create a connection

1. Open your account, create a project, then an app inside it.
2. Choose Website with a server if your backend can keep a secret. Choose Browser app (SPA) if authentication runs in the browser.
3. Add your callback URL and connect the app. Copy its client ID. For a server app, also save the client secret: it is shown only when created or replaced.

A callback must match exactly, including its port and path. You can register 1 to 10 URLs. Use HTTPS in production; HTTP is accepted for localhost and loopback development, for example http://localhost:3000/callback. Wildcards and URL fragments are not accepted.

The project and app IDs organize your connections. The client_id is the value your OAuth library needs. Your users sign in with their existing vixar.id account.

Browser app

The following example uses oidc-client-ts. Install it in your app:

npm install oidc-client-ts@3.5.0

Configure one manager in browser code. Replace the client ID and callback with the values from your account:

import { UserManager, WebStorageStateStore } from 'oidc-client-ts';

const storage = new WebStorageStateStore({ store: window.sessionStorage });
const manager = new UserManager({
  authority: 'https://id.vixar.cc',
  client_id: 'YOUR_CLIENT_ID',
  redirect_uri: 'http://localhost:3000/callback',
  response_type: 'code',
  scope: 'openid profile email',
  loadUserInfo: true,
  fetchRequestCredentials: 'omit',
  requestTimeoutInSeconds: 10,
  automaticSilentRenew: false,
  monitorSession: false,
  stateStore: storage,
  userStore: storage,
});

Call this when the user presses your sign-in button:

await manager.signinRedirect({ nonce: crypto.randomUUID() });

On your /callback page, use the same manager configuration:

const user = await manager.signinRedirectCallback();
history.replaceState(null, '', '/');

The library manages state and S256 PKCE and checks the response. Use user.profile.sub as the account ID in your app and user.profile.preferred_username as the displayed name. A username can change. Do not link accounts by username or email alone.

Keep client_secret out of browser code. To sign out of your app, clear its local session; manager.removeUser() clears this library's stored user. This does not sign the user out of vixar.id.

Website with a server

Configure your backend's OpenID Connect library with the issuer https://id.vixar.cc, your client ID, server secret, exact callback URL and scopes openid profile email. Select Authorization Code and client_secret_basic for token authentication. Keep state, nonce and PKCE verification in the library and validate the ID token's issuer, audience, expiry and signature.

The backend exchanges the callback code at the token endpoint. This command shows the request shape; the variables come from your configuration and the current one-time login attempt:

curl --fail-with-body --user "$CLIENT_ID:$CLIENT_SECRET" \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode "code=$CODE" \
  --data-urlencode "redirect_uri=$REDIRECT_URI" \
  --data-urlencode "code_verifier=$CODE_VERIFIER" \
  https://id.vixar.cc/oauth2/token

Use the access token as Authorization: Bearer <access_token> to read /oauth2/userinfo. Keep the secret on the server. Replacing it in your account immediately invalidates the previous secret, so update your server configuration as part of that change.

Endpoints and fields

openid enables sign-in, profile provides preferred_username, and email provides email and email_verified. New connections support Authorization Code only; they do not receive refresh tokens or a management API token. Public clients require S256 PKCE. Client type is fixed at creation; callbacks can be edited later.

If the callback is rejected, compare the full URL with your account settings. For invalid_client, check the client type, ID and current server secret. For invalid_grant, start a fresh sign-in: a code is short-lived, single-use and bound to its callback and PKCE verifier.