EL OUATINE developer service

“Sign in with EL OUATINE”

Spare your users yet another account: one button signs them in with their EL OUATINE account. You receive a trusted identifier (plus name and email on request) — the password never leaves our platform.

Create an OAuth client Integration guide

From your account on the platform

How it works

Standard OAuth2 flow — Authorization Code

1. Create a clientFrom your account: app name + allowed redirect URIs. You get a client_id and a client_secret — the secret is shown exactly once.

2. Redirect the userSend them to /oauth/authorize with client_id, redirect_uri and the requested scopes (profile, email).

3. Consent screenThe user sees your app name and the requested permissions, then approves or denies — your app never sees their password.

4. Exchange the codeYou receive a code valid for 10 minutes, single use — exchange it via /oauth/token for an access token (1 hour).

5. Read the profileCall /oauth/userinfo with the token: you get the ID and name, and the email only if the email scope was requested.

Scopes

profile — ID + name — the minimum for any sign-in.
email — Registered email address — granted only with the user’s explicit consent.

Integration guide

Create a client and store the secret
POST /api/oauth/v1/clients from a logged-in session — client_secret is shown exactly once. Store it on your server, never in front-end code.
Redirect the user to consent
GET /oauth/authorize?client_id=…&redirect_uri=…&response_type=code&scope=profile%20email&state=… — redirect_uri must exactly match a registered URI.
Exchange the code for a token
POST /oauth/token within 10 minutes: {grant_type:"authorization_code", code, redirect_uri, client_id, client_secret}.
Read the user profile
GET /oauth/userinfo with Authorization: Bearer <access_token> — the token is valid for one hour.

Example: code exchange (curl)

curl -X POST https://securecelleouatine.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "RECEIVED_CODE",
    "redirect_uri": "https://your-app.example/callback",
    "client_id": "eloauth_YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

Example: reading the profile (JavaScript)

const res = await fetch('https://securecelleouatine.com/oauth/userinfo', {
  headers: { 'Authorization': 'Bearer ' + accessToken }
});
const profile = await res.json(); // { sub, name, email? }
if (res.status === 401) { /* token expired or revoked — redirect to consent */ }

Limits

Authorization code: 10 minutes, single use — reuse is rejected.
Access token: 1 hour, no refresh tokens (re-consent afterwards).
redirect_uri: must exactly match a registered URI — https required (http allowed for localhost in development).
/oauth/token is rate-limited: 30 requests/minute per client.
Secrets are stored hashed (SHA-256) and never logged.

Not implemented yet: No OIDC discovery (.well-known) and no ID tokens, no refresh tokens, no PKCE yet — the OAuth2 authorization-code subset is implemented.