Identity Provider — Integration Guide

Documentation for applications integrating with this Identity Provider. It is a standards-based OAuth 2.1 / OIDC authorization server: integrate it the way you would any OAuth provider — redirect users to sign in, exchange the code for tokens, and verify those tokens in your backend.

This Identity Provider

	URL
Issuer	`https://admin.fixweb.cloud`
JWKS	`https://admin.fixweb.cloud/.well-known/jwks.json`
Discovery	`https://admin.fixweb.cloud/.well-known/oauth-authorization-server`
Admin console	`https://admin-admin.fixweb.cloud`
Example app / redirect	`https://app.fixweb.cloud` · `https://app.fixweb.cloud/callback`

What you get as an integrator

Standards-based OAuth 2.1 / OIDC — authorization code + PKCE,

ES256-signed access & refresh tokens, JWKS and discovery endpoints served from the origin root. Use any compliant OAuth/OIDC client library.

A single sign-on surface — your users authenticate once and can be

granted access to your app; identity, roles and permissions arrive in the token.

Multiple sign-in methods — email/password and a range of

social/enterprise providers (the operator chooses which are enabled).

How tokens work

The issuer mints ES256 JWT access tokens. Application claims are nested under a properties object (the OpenAuth subject), not at the top level:

{
  "mode": "access",
  "type": "user",
  "properties": {
    "userID": "usr_123",
    "email": "jane@example.com",
    "name": "Jane Doe",
    "source": "local",
    "roles": ["admin"],
    "permissions": ["users.read", "app:sales:access"],
    "apps": ["sales"]
  },
  "iss": "https://admin.fixweb.cloud",
  "aud": "sales",
  "exp": 1750000000,
  "sub": "usr_123"
}

Relying Parties verify the signature against the published JWKS (https://admin.fixweb.cloud/.well-known/jwks.json) and read identity from properties. See the per-topic guides below.

Documentation

New here? Quickstart walks an external app through the whole path — register, grant, sign in, verify — in five steps.

Applications

Applications — catalogue vs private apps and the

app lifecycle overview.

RBAC grants, JWT permissions / apps.

Connect an app — hostnames (vanity vs platform), JWKS

rules, RP registration, checklist and common failures.

Service tokens — machine / kiosk JWTs (no interactive

Integration guide — the OAuth code + PKCE flow,

endpoints, token structure and server-side verification (PHP + TS).

Sign-in methods — the authentication methods your users