Identity & access
Start with Hybrid ID.
Register a confidential web application and use OpenID Connect Authorization Code with PKCE S256. Your backend validates the Hybrid ID response and establishes its own application session.
- Register an exact HTTPS callback URL and keep the client secret on the backend.
- Request only the approved scopes you need, such as openid, profile, and email.
- Validate the callback with a maintained OIDC library and key your local user by issuer and subject.