# OneLogin

> OneLogin is a standard OpenID Connect provider (authorization code + PKCE).
> This deployment's issuer is https://1login.io. Start with the agent brief below; the discovery
> document is the machine-exact endpoint list. If you cannot open links, the essentials below and
> the same brief as a single file at https://1login.io/llms-full.txt are enough to begin.

## Integrating

- [Agent integration brief](https://1login.io/docs/agents.md): task-oriented Markdown contract for
  AI coding agents - endpoints, prerequisites, required changes in your own system, checklists,
  and the questions to put to your human before writing code
- [Agent brief as a single file](https://1login.io/llms-full.txt): the identical brief in one file, for agents that cannot follow links
- [Integration guide](https://1login.io/docs/integration-guide): the human guide, with plain-PHP and
  Laravel code samples and the full error/rate-limit reference
- [Developer guide](https://1login.io/docs/developer-guide): for the human on the team - the developer portal (sandbox redirect URIs, secret rotation, sandbox inbox) and what needs an administrator
- [OIDC discovery](https://1login.io/.well-known/openid-configuration)
- [JWKS](https://1login.io/.well-known/jwks.json)

## Essentials (if you cannot open any link)

- Protocol: authorization code flow with PKCE (S256, required for every client), then the
  userinfo endpoint. The standard endpoints are listed in the discovery document at
  https://1login.io/.well-known/openid-configuration
- Credentials: a client id, client secret and redirect URI come from this deployment's
  administrator, sandbox application first. Ask your human for them; never invent or guess a client
  id, client secret or redirect URI, and never paste a client secret anywhere.
- Before writing any code, ask your human in ONE message and wait: the sandbox credentials above;
  your framework and language
  version and whether you may add packages; whether your application has a backend that can keep
  a secret (this contract covers that case; with no backend, stop and confirm the application
  type with the administrator); how many environments need sign-in (each needs a registered
  redirect URI); whether existing accounts may be linked by verified email only (the default) and
  whether password login stays; who signs in (customers only is the default; staff or admin
  sign-in is a separate decision); whether you must keep tokens after sign-in (the default is no).
- Never link an existing account on an unverified email; key accounts on the `sub` claim; keep
  the client secret on the server; check `state` on the callback.
- If something does not match this, say so and ask your human; never invent an endpoint, a
  parameter or an error meaning.

## About

- [What OneLogin is](https://1login.io/about)
- [Privacy](https://1login.io/docs/privacy)