Sign in with Anikeen ID

Anikeen ID is a standard OAuth 2.0 authorization server. Your app sends the user to Anikeen ID, the user signs in (and, for third-party apps, approves the requested scopes), and your app gets an access token to call the API on the user's behalf.

Using Laravel?

The SDK wraps all of this in a Socialite provider: see Login with Socialite.

Endpoints

	URL
Authorization	https://id.anikeen.com/oauth/authorize
Token	https://id.anikeen.com/oauth/token
Current user	https://id.anikeen.com/api/v1/user
Logout	https://id.anikeen.com/logout?redirect=<url>

On staging, replace the host with staging.id.anikeen.com.

Authorization code flow

1. Redirect the user

https://id.anikeen.com/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://shop.example.com/auth/callback
  &response_type=code
  &scope=user:read addresses:read orders subscriptions
  &state=RANDOM_STATE

Scopes are separated by spaces. redirect_uri must be one of the redirect URIs registered for your OAuth client. Generate state per request and check it in the callback.

Apps without a secret (single-page, mobile and desktop apps) use the same flow with PKCE (code_challenge and code_challenge_method=S256, code_verifier in the token request).

2. Exchange the code

Anikeen ID redirects back to redirect_uri?code=…&state=…. Exchange the code for tokens:

curl -X POST https://id.anikeen.com/oauth/token \
  -H 'Accept: application/json' \
  -d grant_type=authorization_code \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d redirect_uri=https://shop.example.com/auth/callback \
  -d code=THE_CODE

{
  "token_type": "Bearer",
  "expires_in": 1296000,
  "access_token": "eyJ0eXAiOiJKV1Qi…",
  "refresh_token": "def50200…"
}

3. Read the user

curl https://id.anikeen.com/api/v1/user \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer ACCESS_TOKEN'

The response carries the user's id (their Anikeen ID – store it to recognise the user), name, username, email, avatar and more; see Users & profiles.

Refreshing tokens

Access tokens expire (currently after 15 days; refresh tokens after 30 days). Get a new pair with the refresh token, or send the user through the login again:

curl -X POST https://id.anikeen.com/oauth/token \
  -H 'Accept: application/json' \
  -d grant_type=refresh_token \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d refresh_token=THE_REFRESH_TOKEN

Store the new refresh token: the old one can't be used again.

App tokens (client credentials)

Trusted apps call the /api/v1/client/… endpoints with a token of their own, without a user:

curl -X POST https://id.anikeen.com/oauth/token \
  -H 'Accept: application/json' \
  -d grant_type=client_credentials \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d 'scope=subscriptions:client orders:client'

Personal access tokens

Users can create personal access tokens in their Anikeen ID settings, e.g. for scripts. They are used like OAuth access tokens (Authorization: Bearer …) and carry the scopes the user chose, never a :client scope (those are for app tokens only, see scopes). They currently expire after six months.

Logging out

To sign the user out of Anikeen ID too, send them to /logout with a redirect. The redirect is only followed to Anikeen ID's own pages or to hosts of registered OAuth clients; otherwise the user lands on the login page.

https://id.anikeen.com/logout?redirect=https%3A%2F%2Fshop.example.com%2F

Connected apps beta

Users see the apps they signed in to under Settings → Connected apps in Anikeen ID: the app's logo, the scopes granted and when it was connected and last active. Removing an app there revokes all of its access and refresh tokens of that user at once. Your app notices through 401 answers and a failing refresh: send the user through the login again.

Anikeen can also revoke an app or take its trust away, which revokes every token of the app. Trusted apps that act for users on behalf of other apps can subscribe to app_access.revoked.