Automation

Sign in with Konnos

konnos can act as a login provider for your own product. Users click Sign in with Konnos, approve on konnos.org, and return to your app signed in. This is a custom OAuth 2.0 authorization-code flow (not the git engine on code.konnos.org).

The four pieces

  1. Register an OAuth app in Developer → OAuth apps → get client_id + client_secret (secret once).
  2. Authorize screen — browser opens /login/oauth/authorize on https://konnos.org (login + “Authorize your app”).
  3. Token exchange — your server POSTs to /login/oauth/access_token with the code + secrets.
  4. User profile — GET /login/oauth/userinfo or /api/user with Authorization: Bearer ….

Base URL (critical)

All OAuth URLs use the website host:

https://konnos.org

Not the git host

https://code.konnos.org is only for git push/pull. If you open authorize there you get a terminal-style “pathspec” 404 — that is not OAuth.

Endpoints

# Discovery (SuperTokens / OIDC-style clients)
GET  https://konnos.org/.well-known/openid-configuration

# Authorize (browser)
GET  https://konnos.org/login/oauth/authorize
       ?client_id=kc_…
       &redirect_uri=https://pay.mavifinans.sh/auth/callback
       &response_type=code
       &scope=read:user
       &state=…

# Token (server)
POST https://konnos.org/login/oauth/access_token
  body: client_id, client_secret, code, redirect_uri
        (+ code_verifier if you used PKCE)

# User info (server)
GET  https://konnos.org/login/oauth/userinfo
GET  https://konnos.org/api/user
  header: Authorization: Bearer <access_token>

Callback URL

Register the exact callback your product uses, e.g. mavi pay:

https://pay.mavifinans.sh/auth/callback

The redirect_uri on authorize and on token exchange must match that registered value character-for-character.

SuperTokens third-party style config

If your app uses SuperTokens (or similar) as a client of konnos, point it at discovery or explicit URLs:

// Option A — discovery
oidcDiscoveryEndpoint: "https://konnos.org/.well-known/openid-configuration"

// Option B — explicit
authorizationEndpoint: "https://konnos.org/login/oauth/authorize"
tokenEndpoint:         "https://konnos.org/login/oauth/access_token"
userInfoEndpoint:      "https://konnos.org/login/oauth/userinfo"
clientId:              "kc_…"
clientSecret:          "kcs_…"
scope:                 ["read:user"]

Opaque tokens

Access tokens look like kot_…. They are not JWTs. Always call userinfo to load the user; do not try to decode the token as a JWT.

Renew / re-register

Regenerate secret replaces the client secret and revokes all access tokens and pending codes for that app. Registering again with the same app name under your account removes the older app(s) with that name so you never keep dual Client IDs alive by accident.

What users see

  1. 1

    Your app

    User clicks “Sign in with Konnos”.

  2. 2

    konnos.org

    If needed, they sign in to konnos. Then the Authorize <your app> card asks them to approve profile + email access.

  3. 3

    Back to your app

    Browser returns to your callback with code and state. Your backend finishes the token exchange and creates a local session.