Quickstarts

Each quickstart takes one app from nothing to a working sign-in and sign-out with OpenID Connect: register it in the IdRa console, set its environment variables, paste the code, run it and check the result.

Next.js

App Router route handlers with openid-client.

Express

Server-side sessions with openid-client.

React SPA (PKCE)

Browser-only app with oidc-client-ts and no secret.

Python (Flask)

Flask with Authlib.

Go

net/http with go-oidc and x/oauth2.

Before you start

An IdRa organization where you're an administrator. Use the free hosted service at idra.team, or your own deployment.
Your issuer, which is the same for every app in the organization: https://<your-org>.idra.team/api/auth, or https://<your IdRa address>/api/auth on your own deployment.

What differs from other identity providers

One app covers localhost and production. Web and Single-Page apps accept http on a loopback host with a port, and https on a public host. Redirect URIs match exactly.
PKCE is on by default for every app type, and only S256 is accepted.
Assignment is required. Nobody can sign in to an app until they, or a group they're in, are assigned to it. The console assigns you when you create an app, unless you turn that off.
email and name come from UserInfo, not the ID token.

Moving from Okta? See Migrate from Okta.