This guide is for a partner site that wants to add “Sign in with AF4A” \u2014
letting users authenticate with their existing AF4A identity instead of
creating a new account on your site.<\/p>\n\n\n\n
AF4A uses the OAuth 2.0 Authorization Code flow with mandatory PKCE (S256)<\/strong>. There are no client secrets \u2014 PKCE (a one-time cryptographic proof Base URL:<\/strong><\/p>\n\n\n\n Every endpoint in this guide is reached by appending its path to that base Before you can use this flow, AF4A needs to register your site as an OAuth AF4A will confirm your assigned Before sending the user to AF4A, generate a Stash the verifier (e.g. in The user first signs in (or registers) with their AF4A account, then Response ( Possible error responses ( The returned On your callback page, read Response ( The Possible error responses ( This endpoint is rate-limited (per IP and per client), so build in AF4A does not issue an ongoing access token for your site to call AF4A APIs Returns the public list of AF4A-registered partner apps ( Integrating with AF4A SSO This guide is for a partner site that wants to add “Sign in with AF4A” \u2014letting users authenticate with their existing AF4A identity instead ofcreating a new account on your site. 1. Flow overview AF4A uses the OAuth 2.0 Authorization Code flow with mandatory PKCE (S256). There are no client secrets […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-22","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/af4a.com\/index.php?rest_route=\/wp\/v2\/pages\/22","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/af4a.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/af4a.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/af4a.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/af4a.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=22"}],"version-history":[{"count":2,"href":"https:\/\/af4a.com\/index.php?rest_route=\/wp\/v2\/pages\/22\/revisions"}],"predecessor-version":[{"id":24,"href":"https:\/\/af4a.com\/index.php?rest_route=\/wp\/v2\/pages\/22\/revisions\/24"}],"wp:attachment":[{"href":"https:\/\/af4a.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
generated by your app) is what proves your app is the same one that started
the sign-in, so no secret needs to be stored on your servers.<\/p>\n\n\n\nYour site AF4A\n---------- ----\n1. Generate a code_verifier and derive\n a code_challenge (S256) from it\n2. Send the user to AF4A to sign in\n (user logs in \/ registers, then consents)\n 3. AF4A issues a one-time\n authorization code\n4. AF4A redirects the user back to your\n redirect URI with that code attached\n5. Exchange the code (+ code_verifier)\n for the user's profile\n -> returns { user, connectedApp }\n6. Your site creates its own local session for the user<\/code><\/pre>\n\n\n\nhttps://id.af4a.com\/api<\/code><\/pre>\n\n\n\n
URL \u2014 e.g. https:\/\/id.af4a.com\/api\/oauth\/authorize<\/code>.<\/p>\n\n\n\n2. Register as a partner<\/h2>\n\n\n\n
client. Contact the AF4A team with:<\/p>\n\n\n\n\n
profile<\/code>, email<\/code>). This is currently informational\/display-only: every
successful sign-in returns the full profile shown below, but request only
what you actually use so the consent screen accurately reflects your app.<\/li>\n\n\n\n
send users back to after they approve. Authorization codes can only be
redeemed against this exact value.<\/li>\n<\/ul>\n\n\n\nclientId<\/code> once registered.<\/p>\n\n\n\n3. Step-by-step integration<\/h2>\n\n\n\n
Step 1 \u2014 Generate a PKCE pair<\/h3>\n\n\n\n
code_verifier<\/code> (a random
secret) and derive its code_challenge<\/code> (a SHA-256 hash of that secret,
base64url-encoded). Keep the verifier only in memory or short-lived
client-side storage on the browser tab that starts the flow \u2014 never put it
in a URL.<\/p>\n\n\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replace(\/\\+\/g, \"-\").replace(\/\\\/\/g, \"_\").replace(\/=+$\/, \"\");\n}\n\nfunction generateCodeVerifier(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return base64UrlEncode(bytes);\n}\n\nasync function deriveCodeChallenge(verifier: string): Promise<string> {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier));\n return base64UrlEncode(new Uint8Array(digest));\n}<\/code><\/pre>\n\n\n\nsessionStorage<\/code>, keyed by your clientId<\/code>) so
you can retrieve it once the user is redirected back to your callback page.<\/p>\n\n\n\nStep 2 \u2014 Send the user to AF4A and request authorization<\/h3>\n\n\n\n
reviews and approves a consent screen naming your app and the information
it will access. Once they approve, request an authorization code:<\/p>\n\n\n\nPOST \/oauth\/authorize\nAuthorization: Bearer <the user's AF4A session token>\nContent-Type: application\/json\n\n{\n \"clientId\": \"your-client-id\",\n \"redirectUri\": \"https:\/\/yoursite.example\/callback\",\n \"codeChallenge\": \"<base64url SHA-256 of your code_verifier>\",\n \"codeChallengeMethod\": \"S256\"\n}<\/code><\/pre>\n\n\n\n201<\/code>):<\/p>\n\n\n\n{ \"code\": \"a1b2c3...\" }<\/code><\/pre>\n\n\n\n400<\/code>\/401<\/code>\/404<\/code>, body { \"error\": \"...\" }<\/code>):<\/p>\n\n\n\n\n
clientId<\/code>.<\/li>\n\n\n\nredirectUri<\/code> doesn’t exactly match the one AF4A has on file for your app.<\/li>\n\n\n\ncodeChallengeMethod<\/code> must be \"S256\"<\/code>.<\/li>\n<\/ul>\n\n\n\ncode<\/code> is single-use and expires after 5 minutes<\/strong>. Once you
have it, redirect the user’s browser to your own redirect URI with the code
attached, e.g. https:\/\/yoursite.example\/callback?code=<code><\/code>.<\/p>\n\n\n\nStep 3 \u2014 Exchange the code for the user’s profile<\/h3>\n\n\n\n
code<\/code> from the URL, retrieve the code_verifier<\/code>
you stashed in Step 1, and exchange them for the user’s profile:<\/p>\n\n\n\nPOST \/oauth\/token\nContent-Type: application\/json\n\n{\n \"code\": \"a1b2c3...\",\n \"clientId\": \"your-client-id\",\n \"redirectUri\": \"https:\/\/yoursite.example\/callback\",\n \"codeVerifier\": \"<the original code_verifier from Step 1>\"\n}<\/code><\/pre>\n\n\n\n200<\/code>):<\/p>\n\n\n\n{\n \"user\": {\n \"id\": 4,\n \"name\": \"Jordan Rivera\",\n \"email\": \"jordan@example.com\",\n \"createdAt\": \"2026-06-01T12:00:00.000Z\",\n \"textScale\": \"standard\",\n \"highContrast\": false,\n \"reduceMotion\": false,\n \"screenReaderHints\": false,\n \"voiceControlEnabled\": false\n },\n \"connectedApp\": {\n \"id\": 12,\n \"userId\": 4,\n \"name\": \"Your App Name\",\n \"domain\": \"yoursite.example\",\n \"category\": \"Productivity\",\n \"scopes\": [\"profile\", \"email\"],\n \"connectedAt\": \"2026-07-01T09:00:00.000Z\",\n \"lastUsedAt\": \"2026-07-15T10:00:00.000Z\"\n }\n}<\/code><\/pre>\n\n\n\nuser<\/code> object includes the person’s AF4A accessibility preferences
(textScale<\/code>, highContrast<\/code>, reduceMotion<\/code>, screenReaderHints<\/code>,voiceControlEnabled<\/code>). Partner sites are encouraged to honor these so a
user’s accessibility settings follow them across every site they sign into
with AF4A, not just AF4A itself.<\/p>\n\n\n\n400<\/code>, body { \"error\": \"...\" }<\/code>):<\/p>\n\n\n\n\n
clientId<\/code>.<\/li>\n\n\n\nredirectUri<\/code> doesn’t match the one used in Step 2.<\/li>\n\n\n\ncodeVerifier<\/code> doesn’t
match what was presented in Step 2 \u2014 all of these return a generic
“Invalid or expired code” so a failed attempt doesn’t reveal which check
failed.<\/li>\n<\/ul>\n\n\n\n
reasonable retry\/backoff and avoid retrying automatically in a loop if
something goes wrong.<\/p>\n\n\n\nStep 4 \u2014 Establish your own session<\/h3>\n\n\n\n
later \u2014 this is a one-time identity handoff. Once you have the user<\/code>
object, create your own local session (cookie, JWT, or whatever your site
already uses) and the AF4A part of the flow is complete. If you need to
confirm the user’s identity again later, simply run the flow again.<\/p>\n\n\n\n4. Discovering AF4A partner listings<\/h2>\n\n\n\n
GET \/oauth\/clients<\/code><\/pre>\n\n\n\nclientId<\/code>,name<\/code>, domain<\/code>, category<\/code>, tagline<\/code>, scopes<\/code>, redirectUri<\/code>). This is
unauthenticated and is mainly useful if you’re building a directory or
“available partners” page; an already-integrated partner doesn’t need it.<\/p>\n\n\n\n5. Security notes<\/h2>\n\n\n\n
\n
flow \u2014 security relies entirely on PKCE plus the exact-match redirect
URI. Always use PKCE and never reuse a code_verifier<\/code> across attempts.<\/li>\n\n\n\n
absolute lifetime. In practice this just means a user may occasionally
need to sign back in to AF4A before starting your flow.<\/li>\n\n\n\n
cache or retry them.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"