OAuth 2.0 / OIDC Apps — SyncNexa Docs

SyncID OAuth 2.0 / OpenID Connect (OIDC) allows businesses to provide a seamless "Verify with SyncID" button on their web storefronts, SaaS checkouts, or mobile applications. When clicked, students approve the verification request in their SyncID mobile app or web portal.

OAuth 2.0 Flow Overview

1. User Clicks "Verify with SyncID"

Your frontend redirects the user to the SyncID Authorization Endpoint with your client_id, redirect_uri, scope, and a randomized state nonce.

2. Student Approves Verification

The student reviews the requested claims (e.g. active student status, university name) and approves the zero-knowledge proof generation.

3. Authorization Code Callback

SyncID redirects the student back to your redirect_uri with an authorization code and your original state.

4. Server-Side Token Exchange

Your backend exchanges the code + client_secret for a signed ID token and verification proof object.

Registering an OAuth Client

In the Business Portal at business.syncnexa.co:

Navigate to API & OAuth $\rightarrow$ OAuth Clients tab.
Click Create OAuth Client.
Fill in the client name (e.g., *Student Store Web App*), choose the Environment (Sandbox or Live), and specify one or more Authorized Redirect URIs (e.g., https://yourdomain.com/auth/syncid/callback).
Click Create Client to generate your client_id and client_secret.

Authorization Code Flow

Redirect the user to the authorization URL from your frontend:

verify-button.htmlhtml

1 https://business.syncnexa.co/oauth/authorize?
2   client_id=client_live_4b8f2a9e1c3d
3   &redirect_uri=https%3A%2F%2Fyourdomain.com%2Fauth%2Fsyncid%2Fcallback
4   &response_type=code
5   &scope=openid+profile+student_status+university
6   &state=xyzState123RandomNonce

Exchanging the Code for a Token

When your callback endpoint receives the authorization code, exchange it for access & ID tokens:

curl

1 curl -X POST "https://api.business.syncnexa.co/oauth/token" \
2   -H "Content-Type: application/x-www-form-urlencoded" \
3   -d "grant_type=authorization_code" \
4   -d "code=auth_code_9a8b7c6d5e4f3a2b" \
5   -d "redirect_uri=https://yourdomain.com/auth/syncid/callback" \
6   -d "client_id=client_live_4b8f2a9e1c3d" \
7   -d "client_secret=sec_live_YOUR_CLIENT_SECRET"

Fetching Verified Student Claims

Use the access_token to retrieve the student verification claims:

sample-userinfo-response.jsonjson

1 {
2   "sub": "usr_9c8b7a6f5e4d3c2b",
3   "is_active_student": true,
4   "university_name": "University of Cambridge",
5   "university_domain": "cam.ac.uk",
6   "verification_timestamp": "2026-08-20T11:45:00Z",
7   "proof_valid_until": "2027-06-30T23:59:59Z",
8   "proof_hash": "0x7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
9 }

Was this page helpful?

1	https://business.syncnexa.co/oauth/authorize?
2	client_id=client_live_4b8f2a9e1c3d
3	&redirect_uri=https%3A%2F%2Fyourdomain.com%2Fauth%2Fsyncid%2Fcallback
4	&response_type=code
5	&scope=openid+profile+student_status+university
6	&state=xyzState123RandomNonce

1	curl -X POST "https://api.business.syncnexa.co/oauth/token" \
2	-H "Content-Type: application/x-www-form-urlencoded" \
3	-d "grant_type=authorization_code" \
4	-d "code=auth_code_9a8b7c6d5e4f3a2b" \
5	-d "redirect_uri=https://yourdomain.com/auth/syncid/callback" \
6	-d "client_id=client_live_4b8f2a9e1c3d" \
7	-d "client_secret=sec_live_YOUR_CLIENT_SECRET"

1	{
2	"sub": "usr_9c8b7a6f5e4d3c2b",
3	"is_active_student": true,
4	"university_name": "University of Cambridge",
5	"university_domain": "cam.ac.uk",
6	"verification_timestamp": "2026-08-20T11:45:00Z",
7	"proof_valid_until": "2027-06-30T23:59:59Z",
8	"proof_hash": "0x7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
9	}