Be the client: OIDC end-to-end
Register your own app and sign a user in through the Lab with a real code + PKCE flow.
Registering an OAuth client needs an invite code, which only an instructor can mint — ask for one at akhil@integrauth.com.
- 1
Get an invite (email akhil@integrauth.com) and register an app under “Your apps”.
Client registration is invite-gated; you receive a client_id and a client_secret shown exactly once — the Lab only stores its SHA-256, so copy it now.
- 2
Send a user through /authorize with PKCE (S256), state and a nonce.
The Lab validates your client and the EXACT redirect_uri before anything else, shows a consent screen, then returns a single-use code bound to your PKCE challenge.
- 3
Exchange the code at /oidc/token (client_secret_post or basic).
The code is consumed atomically and hashed at rest; replaying it revokes the tokens it minted. You get an opaque access token and a signed ID token.
- 4
Validate the ID token against /.well-known/jwks.json, then call /oidc/userinfo.
You check iss, aud, exp, signature and your nonce yourself — the same validation a real relying party must perform before trusting a login.
Do it
Read the assignment, get an invite (email akhil@integrauth.com), register your app under your account, then run the full OIDC flow against the Lab. Completion needs client_registered + code_issued + token_granted from your real flow.
Open the assignment →Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.