RAMSESDeveloper Console

VERIFICATION

Exchange once. Verify every claim.

The authorization code is short-lived and single-use. Exchange it only from the component that owns the PKCE verifier.

Exchange the code

POST https://app.ramses.org/identity/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&code=ONE_TIME_CODE
&redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Framses%2Fcallback
&code_verifier=ORIGINAL_PKCE_VERIFIER

Native applications omit client_secret. Their protection comes from the registered callback and PKCE verifier.

Validate the response

  1. 1
    Compare state

    Reject the callback unless it exactly matches the value stored for this attempt.

  2. 2
    Verify the ID token

    Validate signature, issuer, audience, expiry, and nonce using discovery and JWKS.

  3. 3
    Create your session

    Use the verified sub to find or create your account. Keep your roles and permissions in your own backend.

  4. 4
    Protect refresh credentials

    Use an HttpOnly server cookie for web or OS-protected secure storage for native.

Discovery

Load current endpoints and signing keys from the published metadata instead of hardcoding key material. The expected issuer is https://app.ramses.org/identity.

GET https://app.ramses.org/identity/.well-known/openid-configuration