OIDC 2.0 & OAuth 2.0PKCE EnforcedInternal Bridge v1

Developer Integration Guide

Follow this step-by-step tutorial to integrate your applications with clouburstlab. We support the industry-standard OAuth 2.0 Authorization Code Flow with PKCE, Client Credentials for machine-to-machine integration, and an internal bridge for connected cloud storage.

Obtain your client credentials

To start communicating with the identity provider, you need to register your application.

Sign in to your account.
Go to Profile Dashboard > Developer Applications.
Click Register New Application.
Fill in the details and save your Client ID and Client Secret.

Manage Developer Applications

Configure Redirect URIs

Secure your authentication flow

The identity provider will only redirect users back to URLs that you explicitly authorize. This prevents open-redirect attacks.

Navigate to your application settings.
Add your callback URL under Authorized Redirect URIs (e.g., https://yourapp.com/api/auth/callback).
For local development, you can use http://localhost:3000/....

Implement Authorization Flow

Redirect to sign in & consent

Redirect the user to the /signin authorization endpoint with response_type=code and a cryptographic PKCE code_challenge.

GET /signin?
  client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=openid%20profile%20email
  &state=RANDOM_STATE_STRING
  &code_challenge=PKCE_CHALLENGE
  &code_challenge_method=S256

Exchange Code for Token

Handle the callback & verify PKCE

Once the user authenticates, they are redirected back to your app with a code. Exchange it at /api/sso/v1/token for access, refresh, and ID tokens.

POST /api/sso/v1/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=YOUR_AUTHORIZATION_CODE&
redirect_uri=YOUR_REDIRECT_URI&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
code_verifier=YOUR_PKCE_VERIFIER

Fetch User Profile

Use the access token

Now that you have the access_token, use it to fetch the user's profile claims from the /api/sso/v1/userinfo endpoint.

GET /api/sso/v1/userinfo
Authorization: Bearer YOUR_ACCESS_TOKEN

Handle Token Refresh

Maintain offline access

When the access token expires, use the refresh_token with grant_type=refresh_token to request a new access token seamlessly.

POST /api/sso/v1/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&
refresh_token=YOUR_REFRESH_TOKEN&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET

Internal App Bridge & Machine-to-Machine Integration

Cross-subdomain session verification & cloud drives

Internal applications within the *.clouburstlab.com domain can leverage the bridge APIs to seamlessly inspect active user sessions and retrieve decrypted Google Drive, OneDrive, and Dropbox credentials.

A. Machine-to-Machine App Token

POST /api/sso/v1/token Content-Type: application/x-www-form-urlencoded grant_type=client_credentials& client_id=cbl_YOUR_CLIENT_ID& client_secret=cbl_sec_YOUR_SECRET& scope=internal_service

B. Cross-Subdomain User Session Bridge

// Browser fetch from *.clouburstlab.com fetch("https://auth.clouburstlab.com/api/inter-services/v1/user-session?scope=id,firstname,lastname,email,avatar", { credentials: "include", headers: { "Authorization": "Bearer " + appToken } });

C. Decrypted Cloud Storage Credentials

// Retrieve decrypted Google Drive, OneDrive, or Dropbox credentials fetch("https://auth.clouburstlab.com/api/inter-services/v1/connected-drives?provider=google_drive&refresh=true", { credentials: "include", headers: { "Authorization": "Bearer " + appToken } });

AI & Machine Docs (Raw Markdown) View Full API Reference