Connect to
Lynxwares Account.

Register your platform.

Give the studio owner a platform name, a unique client ID, and the exact callback URL. The owner creates it in Studio control → Connected apps. Client secrets are shown once and belong in your server environment.

• Deployed callbacks require HTTPS; local development may use localhost.
• No wildcard callbacks, fragments or credentials in the URL.
• This service registers confidential web clients, using client_secret_basic and mandatory PKCE.

LYNXWARES_ISSUER=https://lynxwares.com
LYNXWARES_CLIENT_ID=your-client-id
LYNXWARES_CLIENT_SECRET=your-private-secret
LYNXWARES_CALLBACK_URL=https://your-platform.example/auth/callback

Use discovery.

Configure a maintained OpenID Connect library with the issuer. It should discover authorization, token, user info and signing key endpoints, and refresh its signing-key cache when keys rotate.

GET https://lynxwares.com/.well-known/openid-configuration

Keep this issuer on your server’s allowlist. Never accept an arbitrary issuer URL from a browser request.

Send the member to sign in.

Generate a fresh state, nonce and PKCE verifier for every attempt. Store them in a short-lived server session. Send the S256 challenge, never the verifier, in the authorization request.

response_type=code
client_id=YOUR_CLIENT_ID
redirect_uri=YOUR_REGISTERED_CALLBACK
scope=openid profile email
state=RANDOM_ONE_TIME_STATE
nonce=RANDOM_ONE_TIME_NONCE
code_challenge=BASE64URL_SHA256_OF_VERIFIER
code_challenge_method=S256

The member signs in and chooses which optional information to share. Treat a cancelled request as a normal outcome and return them to your sign-in screen.

Exchange and verify.

Validate state against the pending session and consume it once. Exchange the code from your server with the same callback, client authentication and original PKCE verifier.

Do not treat a decoded JWT as a verified JWT. Use your OpenID library’s validation. Create your own HttpOnly, Secure, SameSite session after validation.

Keep account linking explicit.

Store the pair iss + sub as the external identity. Ask an existing user to sign in to their current platform account before linking it. Even a verified email match is not permission to merge two accounts.

Email is optional and can be absent. Keep profile names editable, and do not turn Lynxwares roles into your own administrator permissions.

Handle disconnection.

Store tokens on your server. Refresh tokens rotate: replace the old token atomically and serialize simultaneous refreshes. On invalid_grant, clear the connection and ask the member to reconnect.

Disconnecting in Lynxwares revokes its consent and token records. It does not instantly invalidate a JWT already issued to an offline validator, or sign the user out of your app. Limit your own session lifetime and use token introspection when you need immediate revocation checks.

Current lifetimes: authorization codes 2 minutes, access tokens 10 minutes, refresh tokens 7 days. These may change; read expiry values from the response.