Skip to content
Pawan.KrdBeta
IntegrationsOAuth Applications

Integrations

OAuth Applications

Integrating Login with Pawan.Krd allows your users to authenticate using their Pawan.Krd account. By delegating authentication and accessing authorized profile information via OAuth 2.0, you can provide a seamless login experience, verify email addresses, query account balances, and fetch subscription details.

To start using OAuth 2.0, you must first register your application in the developer portal to obtain a client_id and a client_secret. When registering, you will need to specify one or more authorized redirect URIs to secure the token exchange flow.

OAuth 2.0 Specifications
Pawan.Krd implements standard OAuth 2.0 and OpenID Connect (OIDC) protocols, including support for PKCE (Proof Key for Code Exchange) to secure public clients (such as native or single-page applications).

Step 1: Authorization Request

To begin the authorization flow, redirect the user to the Pawan.Krd authorization endpoint. The user will be prompted to log in (if not already authenticated) and grant your application consent to access the requested scopes.

GEThttps://pawan.krd/api/oauth/authorize

Query Parameters

client_idstringrequired
The unique client identifier of your application, obtained from the Pawan.Krd Developer Portal.
redirect_uristringrequired
The URL to redirect the user back to after authorization. This must match one of the authorized redirect URIs registered for your application.
response_typestring
The type of authorization response. Defaults to code.
scopestring
A space- or comma-separated list of scopes indicating what access you are requesting. Supported values include:
openidprofileemailbalancesubscription
statestring
An opaque value used to maintain state between the request and the callback. Recommended to prevent Cross-Site Request Forgery (CSRF).
code_challengestring
Required for public clients (e.g. Single Page Apps, Mobile Apps) using PKCE. The challenge generated from the code_verifier using the method specified in code_challenge_method.
code_challenge_methodstring
The method used to derive the challenge. Commonly S256.

Example Authorization URL

Authorization Link
https://pawan.krd/api/oauth/authorize?client_id=your_client_id&redirect_uri=https%3A%2F%2Fmyapp.com%2Fcallback&response_type=code&scope=openid%20profile%20email&state=secure_state_here

Step 2: Token Exchange

After the user successfully completes the authorization flow, the server redirects them to your redirect_uri with an authorization code parameter. Exchange this code for an access token by making a secure POST request to the token endpoint.

POSThttps://pawan.krd/api/oauth/token

Request Body Parameters

grant_typestringrequired
Must be set to authorization_code.
client_idstringrequired
The application client ID.
client_secretstring
The client secret. Required for confidential clients (server-side applications), but must be omitted for public clients.
codestringrequired
The authorization code received from the authorization server.
redirect_uristringrequired
The redirect URI originally sent in the authorization request.
code_verifierstring
Required if the authorization request used a PKCE code_challenge. The original plain text verifier.

Example Response

A successful exchange returns a JSON payload containing the access token, scopes, and optional session details.

Token Response
1{ 2 "access_token": "at_1234567890abcdef...", 3 "token_type": "Bearer", 4 "expires_in": 3600, 5 "refresh_token": "rt_abcdef123456...", 6 "scope": "openid profile email", 7 "session_token": "st_xyz987654...", 8 "session_expires_at": "2026-08-02T15:36:31Z" 9}

Step 3: Fetching User Profile

Once you obtain an access token, you can fetch the user's profile and account information. Send a GET request to the userinfo endpoint, passing the access token in the standard HTTP Authorization header.

GEThttps://pawan.krd/api/oauth/userinfo

Request Header

Authorization Header
Authorization: Bearer at_1234567890abcdef...

Profile Response Fields

The structure and fields included in the response depend entirely on the authorized scopes:

  • openid: Required for OIDC compatibility. Includes the unique identifier sub.
  • profile: Includes name fields and profile picture. E.g., name, picture.
  • email: Includes the primary email address and verification state. E.g., email, email_verified.
  • balance: Includes account balance information. E.g., balance.
  • subscription: Includes user subscription level, status, and expiration date. E.g., subscription object.
User Profile Response
1{ 2 "sub": "user_987654321", 3 "name": "Pawan Kumar", 4 "email": "[email protected]", 5 "email_verified": true, 6 "picture": "https://pawan.krd/avatar.png", 7 "balance": 15.50, 8 "subscription": { 9 "plan": "Pro Developer", 10 "status": "active", 11 "expires_at": "2026-12-31T23:59:59Z" 12 } 13}