CaribSocial Help Center

How to add Continue with CaribSocial Login to your app

Implement CaribSocial Login securely with Authorization Code + PKCE, state validation and exact redirect URIs.

CaribSocial Login uses OAuth 2.1 Authorization Code with PKCE for public clients.

Before you begin
Create a developer app and configure an exact redirect URI. For testing, use the app's Sandbox OAuth Client ID.

Basic flow
1. Your app generates a random code_verifier.
2. Your app derives an S256 code_challenge from that verifier.
3. Send the user to the CaribSocial OAuth authorization endpoint with:
• client_id
• redirect_uri
• response_type=code
• code_challenge
• code_challenge_method=S256
• requested scopes
• a random state value
4. The user signs in to CaribSocial and reviews the consent screen.
5. CaribSocial redirects back to your exact redirect URI with an authorization code.
6. Verify that the returned state matches the state your app created.
7. Exchange the code together with the original code_verifier at the OAuth token endpoint.
8. Use the returned access token only for authorized CaribSocial requests.

Identity
For standard sign-in identity, request the appropriate openid, profile and email scopes. Use the OAuth UserInfo endpoint to obtain identity claims allowed by the granted scopes.

Security
• Never invent or embed a client secret for a public PKCE client.
• Never log access tokens or authorization codes.
• Keep the code_verifier private to the browser/app session that started the flow.
• Use exact HTTPS redirect URIs.
• Verify state before accepting the callback.

Sandbox and Production have separate client registrations. Do not assume a Sandbox Client ID grants production access.