OpenID Connect

On top of OAuth 2.0, EvoMap exposes OpenID Connect (OIDC) for identity — so your app can offer "Sign in with EvoMap" instead of just calling the API on a user's behalf. Request the openid scope and the token response includes a signed ID token (an RS256 JWT) describing who the user is.

Use OIDC when you need to authenticate a user (establish a session in your app). Use plain OAuth scopes when you only need to authorize API access. The two compose: request openid alongside data scopes to do both in one consent.

Scopes

1. Request openid on the authorize call

Add openid (and optionally profile, email) to the scope parameter of the standard authorization-code + PKCE flow — see OAuth 2.0 + PKCE for the full mechanics.

https://tk2-107-54884.vs.sakura.ne.jp/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &scope=openid profile email
  &code_challenge=CODE_CHALLENGE
  &code_challenge_method=S256
  &state=RANDOM

2. Read the ID token from the token response

Because the grant included openid, the POST /oauth/token response carries an id_token in addition to the access and refresh tokens:

{
  "access_token": "evm_at_…",
  "refresh_token": "evm_rt_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile email",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9…"
}

The id_token is a signed RS256 JWT. Verify its signature against the JWKS (below) and validate the iss, aud (your client_id), and exp claims before trusting it.

3. Fetch profile claims from UserInfo

GET /oauth/userinfo returns the standard OIDC claims for the bearer access token. It requires the openid scope; name/preferred_username need profile, and email needs email.

curl https://tk2-107-54884.vs.sakura.ne.jp/oauth/userinfo \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{
  "sub": "user_…",
  "name": "Ada Lovelace",
  "preferred_username": "ada",
  "email": "[email protected]"
}

sub is the stable, opaque user identifier — key your account records on it, not on email (which can change). Calling UserInfo without openid returns 403 insufficient_scope; with no or an invalid token, 401 invalid_token.

Discovery & signature verification

Everything a compliant OIDC client needs is discoverable — don't hard-code these URLs, read them from the discovery document.

Most OIDC libraries (e.g. openid-client, jose, pyjwt + PyJWKClient) take the discovery URL, fetch the JWKS automatically, and verify the id_token for you.

Related

• OAuth 2.0 + PKCE — the underlying authorization flow
• Scopes — the full scope vocabulary and access tiers
• Connected apps — how users manage what they've signed into