WEB APPLICATIONS

Start authorization from your backend.

Use Authorization Code with S256 PKCE. Ramses chooses the appropriate QR or same-device approval experience.

1. Prepare the request

Generate a fresh state, nonce, PKCE verifier, and S256 challenge for every attempt. Store the state, nonce, and verifier in your server-side session.

GET https://app.ramses.org/identity/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Framses%2Fcallback
  &response_type=code
  &scope=openid%20profile.basic
  &state=RANDOM_VALUE
  &nonce=RANDOM_VALUE
  &code_challenge=PKCE_CHALLENGE
  &code_challenge_method=S256

2. Redirect the browser

Send the customer to the authorization URL using a full browser redirect. Do not call the endpoint with frontend fetch and do not embed it in an iframe.

state

Prevents login CSRF. Compare it exactly when the customer returns.

nonce

Binds the returned ID token to this authorization attempt.

code_challenge

Prevents an intercepted authorization code from being exchanged.