The authorization flow

Sign in with Fades uses the OAuth 2.0 authorization code flow. We recommend PKCE for every app.

1. Send the user to Fades

GET /oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &scope=profile email
  &state=RANDOM_VALUE
  &code_challenge=PKCE_CHALLENGE
  &code_challenge_method=S256

The user signs in (if needed) and approves your app on the consent page.

2. Receive the code

https://yourapp.com/callback?code=ONE_TIME_CODE&state=RANDOM_VALUE

Check that state matches what you sent. If it doesn't, stop. This protects against forged requests.

3. Exchange the code for tokens

POST /oauth/token
  grant_type=authorization_code
  code=ONE_TIME_CODE
  redirect_uri=https://yourapp.com/callback
  client_id=YOUR_CLIENT_ID
  code_verifier=PKCE_VERIFIER

4. Read the user's profile

Call the user info endpoint with the access token to get the profile fields your scopes allow. See Scopes.