Developer documentation

Every organization on DoIt gets its own OpenID Connect issuer, with its own signing key and its own user directory. Your applications integrate with it the same way they would with any identity provider — this is true on the free plan.

Your issuer

Once your organization exists, its issuer lives at your own subdomain. Discovery is standard, so most OIDC libraries need nothing more than this URL:

https://<your-org>.doit.cyou/oauth/.well-known/openid-configuration

Issuer identifier: https://<your-org>.doit.cyou/oauth — note the /oauth suffix. Keys are published at /oauth/.well-known/jwks.json and belong to your organization alone.

Endpoints

Purpose	Path
Discovery	`/oauth/.well-known/openid-configuration`
JWKS	`/oauth/.well-known/jwks.json`
Authorize	`/oauth/authorize/`
Token	`/oauth/token/`
User info	`/oauth/userinfo/`

Authorization code flow with PKCE

PKCE is the recommended flow for web, native and single-page applications, and needs no client secret. Register your application inside your organization to get a client id and your redirect URI allow-list.

GET https://<your-org>.doit.cyou/oauth/authorize/
  ?response_type=code
  &client_id=<your-client-id>
  &redirect_uri=https://yourapp.example.com/callback
  &scope=openid%20profile%20email
  &state=<random>
  &code_challenge=<base64url-sha256-of-verifier>
  &code_challenge_method=S256

Exchange the returned code for tokens:

POST https://<your-org>.doit.cyou/oauth/token/
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<code>
&redirect_uri=https://yourapp.example.com/callback
&client_id=<your-client-id>
&code_verifier=<verifier>

The response carries an id_token signed by your organization's own key. Validate it against your JWKS URL and check that the iss claim matches your issuer exactly.

Scopes and claims

openid is required. profile adds name and username; email adds the address. Claims are returned from the user info endpoint gated by the scopes you requested.

A note on the free plan

The free plan is not a trial and it is not a sandbox. You get a real issuer, a real database and real tokens — the only limit is that your organization has a single user. Adding more people needs a subscription; everything documented here works either way.

Create your organization