Secure my LYFE-ID

Platform

Continue with LYFE

Register your app, wait for LYFE-ID approval, then sign people in with the standard OpenID Connect authorization code flow and PKCE.

Integration guide

Standard OpenID Connect — any certified OIDC client library works.

Issuer
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1
Discovery
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1/.well-known/openid-configuration
Authorize
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1/oauth/authorize
Token
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1/oauth/token
Signing keys (JWKS)
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1/.well-known/jwks.json
UserInfo
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1/oauth/userinfo
Business memberships (organization.membership)
https://ocwrymmzyeyivlkfjpfs.supabase.co/auth/v1/oauth/memberships
  1. Send the user to Authorize with response_type=code, your client ID, an exact registered redirect_uri, scope=openid profile email, a random state and nonce, and code_challenge with code_challenge_method=S256.
  2. The user signs in and approves on LYFE-ID.
  3. On your callback, check state, then exchange the code at Token with your code_verifier. Public client — there is no client secret.
  4. Verify the ID token signature against JWKS, plus iss, aud (your client ID), exp and nonce.
  5. Key your own user record on the token sub, never on email. Your app keeps its own profile and data.

The token carries standard identity claims only. LYFE registry scopes such as organization.membership are enforced at approval time; a membership lookup endpoint for relying apps is still pending.