FAQ

Building

Can I use an OpenID Connect library?

Yes, if it supports discovery, the authorization code flow with PKCE (S256) and ES256-signed ID tokens. Point it at https://id.avonao.com: the discovery document is at https://id.avonao.com/.well-known/openid-configuration. Libraries that insist on refresh tokens, the implicit flow or a public client do not fit. The Quickstart shows the whole flow with fetch and Web Crypto, so you can see what a library does for you.

Can a single-page or mobile app sign members in without a server?

No. Every app has a client secret and the token request must be made with it, so the exchange has to happen on a server you control. A small backend that serves the two routes in the Quickstart is enough; the rest of your app can stay as it is.

Why are there no refresh tokens?

The ID token proves who signed in now. Start your own session from it and manage that session yourself. To check again later that the member still has an Avonao ID session, send them through /authorize with prompt=none: you get a code, or login_required or consent_required, with no screen shown.

How long is everything valid?

• The authorization code: 60 seconds, and one use.
• The ID token: 5 minutes (exp). The access token for /userinfo: 10 minutes.
• The sign-in request itself, while the member signs in at Avonao ID: 30 minutes. After that they may land on their Avonao ID dashboard instead of your app, and start again from your button.

Do I have to send a nonce?

Avonao ID accepts a request without one, but send a fresh one and check it in the ID token: it ties the token to your request. The Security checklist lists it.

Can I test on localhost?

Yes, in development mode: http://localhost and http://127.0.0.1 redirect URIs are accepted for an app in development mode, and refused for a live one. Keep a second app in development mode for your laptop, and use the live app only for your real https addresses.

Can I ask for more than the email and the name?

Not today. The scopes are openid, email and profile; anything else is refused with invalid_scope. If your app needs more about a member, ask in your own onboarding. See Verified claims.

Members

Why is name empty?

The name is what the member chose to call themselves, and it is optional. Do not require it. If you need a name, ask for it in your own onboarding.

What if a member changes their email?

The sub does not change, so key your users by it. The ID token carries the verified email the member has at that sign-in: update the address you store when it differs. See Pairwise ids.

What if the member has no Avonao ID yet?

Add screen_hint=signup to the request (for a Sign up with Avonao ID button) and the member starts at Create your Avonao ID. Without it they start at sign-in. After either, they come back to your app with a code like any other member.

Should my app have its own sign-up and sign-in, or its own Google button?

No. Avonao ID is the only sign-up and sign-in your app offers. Members create their account and sign in at Avonao ID, with an email link, a passkey, or Google, Microsoft or GitHub, which Avonao ID offers itself. Your app never talks to Google, Microsoft or GitHub: it sends the member to Avonao ID and gets one signed ID token back, the same for every way of signing in. The amr claim says how they signed in, if you need it. See Quickstart.

Can I skip the consent screen?

No. For an app of a business the member sees what you ask for the first time they sign in, with your business name and verified domain. It comes back if you ask for more later. See Consent signals.

What happens when a member revokes my app or deletes their Avonao ID?

You get a signed webhook: grant.revoked or member.deleted, and, if you asked for them, member.deletion_requested and member.deletion_cancelled while the 28-day restore window runs. Set an endpoint up, and erase or disconnect as your privacy policy says. See Webhooks.

Does signing out of Avonao ID sign the member out of my app?

No: there is no single logout yet. Your session is yours. You can send the member to the end session endpoint when they ask to sign out of Avonao ID as well; see Sign out.

Does Avonao ID tell me how old the member is?

No. New members confirm that they are at least 16, and that is a self-declaration that is not part of any token. If your service has its own age rules, check them yourself. See Age.

Running your app

What does it cost?

Plans, limits and prices are listed under Billing in the business console, which is where they stay correct. This page does not repeat them.

How do I rotate the client secret?

Add a second secret for the app in the console. Both secrets work from then on, so there is no downtime: deploy the new one to your server, then finish the rotation in the console, which drops the older secret. A secret is shown once, when it is created. See the Security checklist.

Where do I get help?

Write to business-support@avonao.com. Include your client ID, the time of the problem (with the time zone) and the error code you saw. Never send your client secret, a code or a token.