Skip to main content
Sign in with Renaiss lets your application authenticate users with their existing Renaiss account using the standard OpenID Connect (OIDC) authorization-code flow with PKCE. Once integrated, you receive a verified identity token containing the user’s profile, email, wallet, and linked-social claims.
There is no self-service partner portal yet. App registration is handled manually by the Renaiss team. To get a client_id, a client_secret, and your redirect URI added to the allowlist, reach out to the team. That’s also how you sign in to manage your client for now.

​
How it works

Renaiss is a confidential OIDC provider. Your integration follows the standard pattern:
1

Register your app with the team

Send the team your app name and the exact redirect URI(s) you’ll use. They provision a client and hand back your client_id and client_secret over a secure channel.
2

Discover the endpoints

Point your OIDC client at the discovery document and it derives the authorize, token, userinfo, and JWKS endpoints automatically.
3

Run the authorization-code + PKCE flow

Redirect the user to Renaiss to consent, exchange the returned code for tokens, and verify the id_token.
4

Read the user's claims

Use the verified claims from the id_token (or call the userinfo endpoint).

​
Prerequisites

Before you begin, you need:
  • A client_id and client_secret issued by the Renaiss team (see the callout above).
  • One or more exact redirect URIs registered on the allowlist.
  • An OIDC client library. Examples below use Node’s openid-client, but any compliant OIDC library works.
The client_secret is a password. Keep it server-side only: never ship it to the browser or commit it to a repository. Share it only over a secure channel. Renaiss stores it hashed, so if it leaks, contact the team to rotate it.

​
Configuration

Provide your integration with the following settings. Replace the bracketed values with the credentials and redirect URI the team gave you.
.env
The discovery document is always ${RENAISS_ISSUER}/.well-known/openid-configuration. Point your OIDC client at that URL and it resolves the rest of the endpoints for you.

​
Client settings

Your client is provisioned as a confidential client with these defaults:

​
Choosing an issuer

The RENAISS_ISSUER determines which environment you authenticate against. Use the value the team gives you during onboarding:
Only localhost may use plain http. All deployed issuer hosts are HTTPS-only.

​
Redirect URI must match exactly

Renaiss uses an exact-match, anti-phishing allowlist with no wildcards, trailing slashes, or port changes. The redirect URI your app sends must be byte-for-byte identical to a registered one. Need to add or change a URL (a new port, a deployed https://... callback, etc.)? Send it to the team to allowlist. Registering it only on your side is not enough. Add prompt=consent to the authorize request to force the consent screen on every sign-in. Omit it and the user sees consent only the first time they authorize your app:

​
Quick start

Using Node and openid-client:
1

Discover the provider

Load ${RENAISS_ISSUER}/.well-known/openid-configuration to configure your client.
2

Build the login route

Generate a PKCE code_verifier / code_challenge (S256), a random state, and a nonce. Stash them in the session, then redirect to the authorize endpoint with scope=openid profile email safe x (add prompt=consent to force the consent screen on every sign-in).
3

Handle the callback

At your redirect path, verify state, exchange the code at the token endpoint (secret in the request body), and verify the id_token signature against the JWKS, checking iss, aud, exp, and nonce.
4

Read the claims

Read the user’s claims from the verified id_token, or call the userinfo endpoint.
A complete, dependency-light reference implementation using openid-client is available from the team on request during onboarding.

​
What you get back

These claims are returned in the id_token and from the userinfo endpoint, gated by the scopes you requested: Behaviors to handle:
  • sub is opaque and stable, so store and key on it; never parse it for meaning.
  • safe_wallet_address: null means the wallet isn’t ready yet. Show a soft retry/empty state; do not hard-fail the login.
  • Always verify the id_token signature plus iss / aud / exp / nonce. A compliant OIDC library does this for you.

​
Token exchange smoke test

Once you have an authorization code and the matching code_verifier, you can exchange them directly to sanity-check your client:
A successful response returns an access_token, id_token, and (if requested) a refresh_token.

​
Get help

App registration, credentials, redirect-URI changes, and secret rotation are all handled by the Renaiss team while the self-service portal is in progress.

Contact the Renaiss team

Reach out to register your app, get your credentials, or add a new redirect URI to the allowlist. We’ll turn it around quickly.