Real code, against this platform's real endpoint shapes — not generic OAuth boilerplate. Every guide below authenticates a registered Application's end users through the exact same Authorization Code + PKCE contract this platform's own dashboard uses on itself, verified end to end.
https://accounts.onehux.com serves the hosted login/logout pages a browser is redirected
to (/login, /end-session). https://api-accounts.onehux.com serves the actual OAuth API your backend calls server-to-server
(/api/v1/oauth/token/, /api/v1/oauth/userinfo/). These are not
interchangeable — accounts.onehux.com/api/* is
not proxied to the backend at all, and returns the frontend's own 404 page rather than
an error your HTTP client recognizes as JSON. This was found (README.md ADR-070) by
running a real, separate local test app through the full flow against production, not
assumed — every code sample below uses the correct host for each call.
Redirect an unauthenticated visitor's browser to https://accounts.onehux.com/login with your
own client_id/redirect_uri/ code_challenge/code_challenge_method/ scope/state — a real, branded login page shows every currently-real first-factor option
(password, magic link, email code, Google, passkey — see Sign-in methods),
and the browser lands back at your own registered redirect_uri with a real code — the classic
"redirect, callback, exchange" shape, now true for every method, not just Google. You
never build a login form yourself. Every code sample below demonstrates this exact
pattern.
True SSO, for free: if the visitor's browser already holds a valid session with this platform (from signing into your app, another app, or the dashboard itself), the redirect above completes silently — no form shown at all — and your app gets its code immediately. Nothing extra to build for this; it's the same redirect either way.
Logging out — RP-initiated, real SLO: redirect to https://accounts.onehux.com/end-session?client_id=&post_logout_redirect_uri=&state= to actually end the platform-wide session (not just clear your own app's local
cookie/token) — every other Application relying on that same session is signed out too,
the real SLO promise this platform is built around. Register your post_logout_redirect_uri too: it's validated against the same registered redirect_uris list as your login callback, not
a separate list — omit it there and /end-session rejects the request with a real 400, even
though your login callback works fine.
RP-initiated logout only notifies the app the user actually
clicked "log out" in. The shared session genuinely, immediately revokes either
way — and if the user logs out of a different app, or directly at accounts.onehux.com, this platform pushes a
real, spec-compliant OIDC Back-Channel Logout logout_token to any registered Back-Channel Logout endpoint as soon as the revocation happens —
see a backend guide for the exact registration call. Without registering one, your
app's local session state keeps showing "signed in" until its next real /userinfo call fails, bounded by the access
token's 15-minute lifetime — never treat a locally-held session as a live signal of the
IdP's true logout state unless you've wired up the push.
PKCE generation, the redirect, callback handling, code-for-token exchange, and session
establishment — your backend holds a real client_secret,
so it authenticates as a confidential client at the token exchange.
A genuinely different pattern from a web backend — no BFF, no server-held secret. The system browser (never an embedded webview), PKCE, a deep-link callback, and OS-level secure token storage.
One page, not five near-duplicate framework guides — there's genuinely little framework-specific content once you understand the shape: your frontend never talks to this platform directly.