Custom website

Use a custom integration when your platform is neither Drupal nor WordPress, or when you need direct control over sessions, routing, and profile-based behavior.

• A backend capable of keeping credentials and tokens secret
• HTTPS callback routes
• A server-side session mechanism
• A DocID^® client for each environment

Your application normally needs:

1. A login route that generates state, nonce, and the PKCE values before redirecting to DocID^®
2. A callback route that validates the response, exchanges the code, reads the approved claims, and creates a local session

Store temporary authorization data in a signed, HTTP-only, secure, same-site cookie or in a server-side transaction store.

Redirect the browser to /oauth2/authorize with:

On the server:

1. Reject callbacks with a missing or mismatched state.
2. Handle an OAuth error response without exposing technical details to the user.
3. Exchange the authorization code at /oauth2/token.
4. Send the original code_verifier.
5. Request /oauth2/userinfo with the access token.
6. Map sub to your local account or session.
7. Remove the temporary OAuth transaction data.

See the complete OAuth 2.0 flow