Authorize an account with PKCE
Use authorization code plus S256 PKCE for confidential and public applications.
- Generate a cryptographically random state and a new PKCE verifier for each authorization. Compute the S256 challenge.
- Redirect to the authorization endpoint with client_id, exact redirect_uri, response_type=code, scope, state, code_challenge and code_challenge_method=S256.
- The customer signs in, selects their personal or organization account, reviews the scopes and accepts any billing plan.
- Verify state at your callback. Exchange the code once, with the original redirect URI and code_verifier.
- Store tokens securely. Use the returned client-scoped subject as the customer identifier.
POST
https://auth.shareai.now/oauth/token- Base URL
https://auth.shareai.now- Authentication
- Public client ID + PKCE, or confidential client authentication + PKCE
cURL
curl --fail-with-body 'https://auth.shareai.now/oauth/token' --data-urlencode 'grant_type=authorization_code' --data-urlencode "client_id=$SHAREAI_CLIENT_ID" --data-urlencode "code=$AUTHORIZATION_CODE" --data-urlencode 'redirect_uri=https://your-app.example/callback' --data-urlencode "code_verifier=$PKCE_VERIFIER"
This example is for a public client. Do not add a secret or HTTP Basic credentials. A confidential client authenticates using its server-side client credentials in addition to PKCE. Never ship a confidential secret in browser, desktop, mobile or self-hosted distributions.
Discovery: https://auth.shareai.now/.well-known/openid-configuration. Use the advertised endpoints and signing keys. Reject state mismatches, unexpected issuers and invalid ID-token audience or signature.
Standards: OAuth security best practices and PKCE. Refresh tokens.
Last updated September 18, 2026