Sign in with UmmahPassport.

How it works

OIDC, the standard one.

Four steps. The same four steps every OIDC provider implements, because there’s only one specification. If you’ve integrated Google Sign-In before, you’ve done this.

1. 1

   Register your app

   Open the developer portal, register your app, get a client_id and client_secret. Add your callback URLs (must be HTTPS in production).

2. 2

   Add a 'Sign in with UmmahPassport' button

   Standard OIDC: GET https://ummahpassport.com/sso/authorize?client_id=YOUR_ID&redirect_uri=…&state=…&scope=openid email profile. The user signs in on our domain, we redirect back to your callback with an auth code.

3. 3

   Exchange the code for tokens

   Your server POSTs to /api/sso/token with the code, client_id, client_secret. Get back access_token + id_token. The id_token is a signed JWT carrying { sub, email, email_verified, exp, iat }.

4. 4

   Use the access token (optional)

   GET /api/sso/userinfo with Bearer token returns the profile. Or you can just trust the id_token claims directly — the cryptographic signature is the verification.

// Sign in with UmmahPassport using Auth.js (NextAuth)
import NextAuth from "next-auth";

export const { handlers } = NextAuth({
  providers: [
    {
      id: "ummahpassport",
      name: "UmmahPassport",
      type: "oidc",
      issuer: "https://ummahpassport.com",
      clientId: process.env.UMMAHPASSPORT_CLIENT_ID,
      clientSecret: process.env.UMMAHPASSPORT_CLIENT_SECRET,
      // We accept client_secret_post (not Basic). PKCE is also
      // enabled by default in Auth.js v5, and we support S256.
      client: { token_endpoint_auth_method: "client_secret_post" },
    },
  ],
});

Same shape works with passport-openidconnect (Node), Authlib (Python), Pac4j (Java), MSAL (.NET), Spring Security OAuth, oidc-client-ts, msal-browser, etc. The discovery document at /.well-known/openid-configuration is the same one OIDC libraries already know how to read.