Setting up Lobyco IDP for your website(s)

Use Lobyco as the identity provider for your own websites.

This page describes how to integrate the Lobyco Member Management scope into your existing website(s).

This page is relevant to you if you are using Lobyco Member Management for storing your membership data and using Lobyco Identity Provider (IDP) for Sign-in, Sign-up and customers’ membership profile.

Lobyco’s Member Management includes customers sign-in, sign-up and MyProfile pages.

These are web-based and are being used in your Lobyco white label app as well as they can be integrated on your existing cooperate website, online shopping site etc.

Lobyco Identity supports OAuth 2.0 Authorization Code Flow with PKCE for secure authentication and token management. External or public web applications (e.g. SPAs) can integrate using this standard flow to authenticate users and call Lobyco APIs without exposing a client secret.

It is strongly recommended to use a standard OAuth 2.0 / OIDC client library provided for your front-end framework.
These libraries handle PKCE generation, redirects, token storage, and silent renewals automatically.

Prerequisites

Reach out to Lobyco to register the website as a public OAuth client in Lobyco Identity solution.
The following details must be provided during registration:

• Client name (application name)
• Redirect URIs — the exact URLs where users are redirected after authentication (for example https://example.com)

You will receive:

• IDENTITY_BASE_URL
• CLIENT_ID

Integration Steps

1. Redirect the User to the Authorization Endpoint

   GET {IDENTITY_BASE_URL}/oauth2/auth
   ?client_id={CLIENT_ID}
   &response_type=code
   &audience={AUDIENCE_1}+{AUDIENCE_2}
   &redirect_uri={CLIENT_REDIRECT_URI}
   &scope={SCOPE_1}+{SCOPE_2}
   &state={STATE_VALUE}
   &nonce={NONCE_VALUE}
   &code_challenge={CODE_CHALLENGE}  
   &code_challenge_method=S256
   

   The user authenticates and authorizes the application. Lobyco Identity redirects back to your specified redirect_uri with an authorization code.

2. Exchange the Authorization Code for Tokens

   POST {IDENTITY_BASE_URL}/oauth2/token
   Content-Type: application/x-www-form-urlencoded
   
   grant_type=authorization_code
   code={AUTHORIZATION_CODE}
   redirect_uri={REDIRECT_URI}
   client_id={CLIENT_ID}
   code_verifier={CODE_VERIFIER}
   

   The response includes:

   • access_token — for accessing Lobyco APIs
   • id_token — containing user identity information (if OIDC enabled)
   • refresh_token — for renewing tokens (if allowed)
3. Use the Access Token in API Requests

   Authorization: Bearer {ACCESS_TOKEN}

   When validating tokens on the back end, choose the correct validation method depending on the token type:

   • JWT access tokens: validate locally using the issuer’s jwks_uri.
   • Opaque access tokens: call the introspection endpoint (for example /oauth2/introspect)

Scopes required for Sign-in and Sign-up pages

• openid
• offline_access

Scopes required for MyProfile web page

• openid
• offline_access
• profile
• profile.edit