Overview

This section is for application developers integrating an app against Ionize. You don't need to understand Ionize's internals, only the OAuth2/OIDC protocol surface and a few Ionize-specific defaults.

OAuth2 flows

• OAuth2 overview, when to use which grant.
• Authorization Code, server-side web apps.
• Authorization Code + PKCE, SPAs, mobile apps, CLIs. Mandatory for all public clients in Ionize.
• Client Credentials, server-to-server / M2M.
• Refresh Tokens, long-lived sessions.
• OAuth2 Error Codes, RFC 6749 and Ionize-specific.

OIDC

• OIDC Discovery, the .well-known endpoint, JWKS.
• OIDC userinfo, getting profile data after login.
• RP-initiated logout, the standard OIDC logout flow.

Integration patterns

• SPA integration, single-page apps end-to-end.
• Mobile integration, iOS / Android specifics.
• MCP with Deploy, driving deployments programmatically from Claude.

Where to find the OAuth2 endpoints

Use the standard discovery endpoint:

https://ciam.your-domain.example/.well-known/openid-configuration
https://iam.your-domain.example/.well-known/openid-configuration

For local development:

http://localhost:3102/.well-known/openid-configuration   # CIAM
http://localhost:4102/.well-known/openid-configuration   # IAM