We run the sign-in. You keep the brand.登录交给我们，品牌留给你

Node · openid-client

import * as oidc from "openid-client";

const config = await oidc.discovery(
  new URL("https://inkwell.authanyid.com"), "<client_id>", "<client_secret>");

// 1. Send the user to /oauth2/authorize with PKCE// 1. 带上 PKCE，跳到 /oauth2/authorize
const verifier = oidc.randomPKCECodeVerifier();
const url = oidc.buildAuthorizationUrl(config, {
  redirect_uri: "https://inkwell.example/callback",
  scope: "openid",
  code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
  code_challenge_method: "S256",
});
// redirect the user to url.href; keep verifier in the session for step 2// 把用户重定向到 url.href；verifier 存进 session，第 2 步要用

// 2. Callback: exchange the code; the library checks the ID token’s claims// 2. 回调：用 code 换令牌，库会校验 ID 令牌的声明
const callbackUrl = new URL(req.url, "https://inkwell.example");
const tokens = await oidc.authorizationCodeGrant(config, callbackUrl,
  { pkceCodeVerifier: verifier });
console.log(tokens.claims().sub);

Python · Authlib

from flask import Flask, url_for
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = "<random secret>"  # Authlib keeps PKCE state in the session# Authlib 把 PKCE 状态存在 session 里
ISSUER = "https://inkwell.authanyid.com"
oauth = OAuth(app)
oauth.register(
    "authany",
    server_metadata_url=f"{ISSUER}/.well-known/openid-configuration",
    client_id="<client_id>", client_secret="<client_secret>",
    client_kwargs={"scope": "openid", "code_challenge_method": "S256"},
)

@app.get("/login")  # to /oauth2/authorize, with PKCE# 跳到 /oauth2/authorize，带 PKCE
def login():
    return oauth.authany.authorize_redirect(url_for("callback", _external=True))

@app.get("/callback")  # exchanges the code, verifies the ID token# 换取令牌并校验 ID 令牌
def callback():
    token = oauth.authany.authorize_access_token()
    return token["userinfo"]["sub"]