Developer Integration Guide

Follow this step-by-step tutorial to integrate your applications with clouburstlab.We support the industry-standard OAuth 2.0 Authorization Code Flow with PKCE for secure authentication.

Obtain your client credentials

To start communicating with the identity provider, you need to register your application.

Sign in to your account.
Go to Profile Dashboard > Developer Applications.
Click Register New Application.
Fill in the details and save your Client ID and Client Secret.

Configure Redirect URIs

Secure your authentication flow

The identity provider will only redirect users back to URLs that you explicitly authorize. This prevents open-redirect attacks.

Navigate to your application settings.
Add your callback URL under Authorized Redirect URIs (e.g., https://yourapp.com/api/auth/callback).
For local development, you can use http://localhost:3000/....

Implement Authorization Flow

Redirect to authorize

Redirect the user to the authorization endpoint. Make sure to generate a PKCE code_challenge.

GET /api/sso/v1/authorize?
  client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=openid profile email
  &state=RANDOM_STRING
  &code_challenge=PKCE_CHALLENGE
  &code_challenge_method=S256

Exchange Code for Token

Handle the callback

Once the user authenticates, they are redirected back to your app with a code. Exchange it for access tokens.

POST /api/sso/v1/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=YOUR_AUTHORIZATION_CODE&
redirect_uri=YOUR_REDIRECT_URI&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
code_verifier=YOUR_PKCE_VERIFIER

Fetch User Profile

Use the access token

Now that you have the access_token, use it to fetch the user's profile from the /api/sso/v1/userinfo endpoint.

GET /api/sso/v1/userinfo
Authorization: Bearer YOUR_ACCESS_TOKEN

Handle Token Refresh

Maintain offline access

When the access token expires, use the refresh_token to request a new access token without requiring the user to sign in again.

POST /api/sso/v1/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&
refresh_token=YOUR_REFRESH_TOKEN&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET