Sign in with WidgetStore (OAuth 2.1 / OpenID Connect) for developers

Anyone can create an app in the developer console and let people sign in with their WidgetStore account. People who are already signed in to WidgetStore just tap Allow. They choose what you can see, and they can disconnect your app anytime in Account → Apps & API.

1. Create an app

In /developers, click New app and fill in:

• Name, icon, homepage and a privacy policy URL (required). People see these on the consent screen.
• Redirect URIs, one per line. They must match exactly: no wildcards, no extra slash, no different query. https only; native apps may also use loopback (http://127.0.0.1/..., any port) or a custom scheme.
• App type: Server app gets a client secret (shown once, stored only as a hash). Browser or native app has no secret.

You can create 3 apps on Free and 10 on Pro. New apps show an "unverified" notice and can have up to 100 users until we review them.

2. Send people to authorize

GET https://widgetstore.net/oauth/authorize
  ?response_type=code
  &client_id=wsc_...
  &redirect_uri=https://example.com/auth/callback
  &scope=openid profile email
  &state=<random>
  &nonce=<random>
  &code_challenge=<BASE64URL(SHA256(verifier))>
  &code_challenge_method=S256

• PKCE with S256 is required for every app, including server apps.
• Check that state comes back unchanged (CSRF). We also return iss.
• prompt=none checks silently: you get a code if the person is signed in and has already approved, otherwise login_required or consent_required. prompt=consent always shows the screen.

3. Exchange the code

POST https://widgetstore.net/widget/api/oauth/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64(client_id:client_secret)   # server apps only

grant_type=authorization_code&code=...&code_verifier=...&redirect_uri=...

You get access_token (1 hour), refresh_token (rotates on every use; reusing an old one revokes the whole authorization) and id_token. Codes work once and expire in 10 minutes.

4. Verify the ID token

• Signed with ES256. Keys: https://widgetstore.net/widget/api/oauth/jwks (match kid).
• Check iss = https://widgetstore.net, aud = your client ID, exp, and that nonce matches.
• sub is unique to your app. The same person gets a different sub in another app, so apps can't link people together.
• Claims follow the scopes the person allowed: profile → name, picture; email → email, email_verified.

Discovery: https://widgetstore.net/.well-known/openid-configuration. UserInfo: GET https://widgetstore.net/widget/api/oauth/userinfo with the access token.

Scopes

Scope	What you get
openid	Required to sign people in
profile	Name and avatar
email	Verified email address
read, write:*	Their widgets, page and data through the open API and MCP

Rules

• Ask only for what you need. People can uncheck profile and email.
• Never ask people for their WidgetStore password or email codes.
• Revoke tokens when people sign out of your app: POST https://widgetstore.net/widget/api/oauth/revoke.
• We may disable apps that mislead people or misuse data. Disabled apps can't get new authorizations or refresh tokens.