Documentation

1. Discovery & Endpoints

The Orneos OpenID Connect provider publishes its configuration at https://orneos.eu/.well-known/openid-configuration. The issuer (iss) of RS256-signed JWT tokens is always https://orneos.eu.

Browser authorization and user consent take place on https://login.orneos.eu/oauth/authorize, while back-channel calls (/oauth/token, /oauth/userinfo, /oauth/revoke, /oauth/jwks) are served on https://orneos.eu.

curl -s https://orneos.eu/.well-known/openid-configuration | jq .

2. Authorization & PKCE (S256 Mandatory)

Every third-party application (both confidential and public) must use PKCE (RFC 7636) with the S256 method. Requests without a code_challenge or using plain are rejected.

Generate a cryptographically random code_verifier (43 to 128 URL-safe characters), compute its base64url-encoded SHA-256 hash (code_challenge), and redirect the user to https://login.orneos.eu/oauth/authorize.

• response_type=code and code_challenge_method=S256 are required
• scope: openid (required), profile (display name, username, avatar), email (verified email address)
• state: random CSRF token verified when the user returns to your redirect_uri
• prompt=consent (optional): forces the consent screen to be displayed again

https://login.orneos.eu/oauth/authorize
  ?client_id=orn_0123456789abcdef01234567
  &redirect_uri=https%3A%2F%2Fexample.com%2Foauth%2Fcallback
  &response_type=code
  &scope=openid%20profile%20email
  &state=9f8e7d6c5b4a3f2e1d0c
  &code_challenge=E9Melhoa2OwvFrGMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256

3. Code Exchange & Refresh Token Rotation

Once the user grants consent, Orneos redirects to your redirect_uri with ?code=...&state=.... The authorization code is valid for 120 seconds and is single-use.

Exchange it at POST https://orneos.eu/oauth/token along with your code_verifier. You receive an access_token (1 hour), an RS256-signed id_token, and a refresh_token (90 days, one-time rotation).

Every grant_type=refresh_token call immediately invalidates the used token and issues a new one. If an already-consumed refresh_token is replayed, the entire session family for that user and client is revoked.

curl -X POST https://orneos.eu/oauth/token \
  -u "orn_0123456789abcdef01234567:orns_YOUR_SECRET" \
  -d "grant_type=authorization_code" \
  -d "code=RECEIVED_CODE" \
  -d "redirect_uri=https://example.com/oauth/callback" \
  -d "code_verifier=YOUR_CODE_VERIFIER"

curl -X POST https://orneos.eu/oauth/token \
  -u "orn_0123456789abcdef01234567:orns_YOUR_SECRET" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=ornr_YOUR_REFRESH_TOKEN"

4. UserInfo & Token Revocation (RFC 7009)

Call GET https://orneos.eu/oauth/userinfo with Authorization: Bearer <access_token> to fetch the claims matching the scopes granted by the user.

To sign a user out or revoke access server-side, send their refresh_token or access_token to POST https://orneos.eu/oauth/revoke.

curl -H "Authorization: Bearer ACCESS_TOKEN" https://orneos.eu/oauth/userinfo

curl -X POST https://orneos.eu/oauth/revoke \
  -u "orn_0123456789abcdef01234567:orns_YOUR_SECRET" \
  -d "token=ornr_YOUR_REFRESH_TOKEN"

5. Official “Sign in with Orneos” Button

Use the official button snippet below to provide a consistent, accessible sign-in experience in light or dark mode.

<a class="orneos-signin-btn" href="/auth/orneos">
  <svg aria-hidden="true" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2">
    <circle cx="12" cy="12" r="9"/>
    <path d="M12 3a9 9 0 0 0 0 18"/>
  </svg>
  <span>Sign in with Orneos</span>
</a>

<style>
.orneos-signin-btn {
  display: inline-flex; align-items: center; gap: 10px;
  padding: 10px 18px; border-radius: 8px; font: 600 15px/1.2 system-ui, sans-serif;
  background: #ffffff; color: #0f172a; border: 1px solid #cbd5e1; text-decoration: none;
}
.orneos-signin-btn:hover { border-color: #002FA7; color: #002FA7; }
</style>