Overview
0account is a standard OpenID Connect provider. If your framework already has a "Sign in with…" button, adding 0account is the same work: a client id, a client secret, and one discovery URL.
There is no SDK to install. Anything that speaks OIDC works.
Discovery
https://v1.0account.com/.well-known/openid-configuration
Point your library at that and it finds the rest. The endpoints below are listed only so you can recognise them in logs.
| Endpoint | URL |
|---|---|
| Authorization | https://v1.0account.com/oauth/authorize |
| Token | https://v1.0account.com/oauth/token |
| UserInfo | https://v1.0account.com/oauth/userinfo |
| End session | https://v1.0account.com/oauth/logout |
| JWKS | https://v1.0account.com/.well-known/jwks.json |
Pick a guide
Each ends with a working sign-in. They differ only in how much the library does for you.
| Guide | Use when |
|---|---|
| Auth.js | Next.js, SvelteKit, Nuxt. Least code. |
| Passport.js | Express, or an existing Passport setup |
| openid-client | Node without a framework, or you want the flow visible |
| goth | Go, several providers |
| go-oidc | Go, one provider, no extra layer |
Not listed? Django Allauth, Laravel Socialite, Spring Security, Auth0's libraries and many others accept a generic OIDC provider — give them the discovery URL.
What you need
Create an app at my.0account.com/apps, then copy two values:
- Client ID — your app id.
- Client secret — shown once, prefixed
0account_sec_. This must be kept secret.
Send the secret exactly as issued, prefix included.
Register at least one redirect URI. Sign-in cannot complete without one: the authorization endpoint matches what your library sends against that list, and an unregistered URI is rejected. Allowed origins are separate and only needed when a browser calls our API directly — a server-side integration needs none.
State and PKCE
Your library handles both. State is optional per RFC 6749 and strongly recommended; PKCE is required for public clients and harmless for confidential ones. Every library listed above does both by default — if you are writing the flow by hand, do not skip them.
After sign-in
- Logout and sessions — ending a session, and hearing about it when someone else ends it.