Calimatic
Developer PortalSign in

Calimatic OIDC / OAuth 2.0 Provider

Integrate your application with the Calimatic Auth platform using standards-compliant OpenID Connect and OAuth 2.0.

OAuth 2.0 (RFC 6749)OpenID Connect Core 1.0PKCE (RFC 7636)Token Introspection (RFC 7662)Token Revocation (RFC 7009)Dynamic Registration (RFC 7591)

Quick Links

Discovery DocumentJWKS Endpoint

API Reference

Complete reference for all OIDC/OAuth2 endpoints including authorization, token, userinfo, introspection, revocation, and dynamic client registration.

Integration Guide

Step-by-step guides for integrating your app using Next.js, React SPA, Python, PHP, or any standard OAuth2 client library. Includes migration guide from the legacy exchange flow.

Architecture

Internal implementation details covering RSA key management, token lifecycle, database schema, consent system, rate limiting, and the relationship between the platform and Keycloak.

Getting Started

The Calimatic Auth platform is a standards-compliant OIDC/OAuth2 provider. Any OAuth 2.0 client library can integrate by pointing to the discovery URL:

https://auth.calimatic.com/.well-known/openid-configuration

The provider supports three grant types:

  • Authorization Code + PKCE — Web apps, SPAs, and mobile apps (user authentication)
  • Refresh Token — Renewing expired access tokens
  • Client Credentials — Machine-to-machine communication (no user context)

All tokens are signed with RSA (RS256) and can be verified using the public keys at the JWKS endpoint.

Using these credentials against the REST API

The same client_id and client_secret you use for OIDC also authenticate platform REST API calls (/api/v1/organizations/*, /api/v1/users/*, etc.). Two equivalent modes are supported:

  • App Client (Basic) — send x-client-id and x-client-secret headers on every request. Simplest for service-to-service calls.
  • OAuth2 Bearer — first call POST /api/v1/oidc/token with grant_type=client_credentials, then send the resulting access token as Authorization: Bearer <token>. Tokens can be cached for their full TTL (default 1 hour).

Note: only client_credentials tokens are accepted on REST endpoints. User-context tokens (from authorization_code) will return 401 — use the NextAuth session cookie for user-context calls.

See the User Management API reference for full request/response details on each endpoint.

Base URL

https://auth.calimatic.com

Endpoints at a Glance

DiscoveryGET/.well-known/openid-configuration
AuthorizationGET/api/v1/oidc/authorize
TokenPOST/api/v1/oidc/token
UserInfoGET / POST/api/v1/oidc/userinfo
JWKSGET/api/v1/oidc/jwks
IntrospectionPOST/api/v1/oidc/introspect
RevocationPOST/api/v1/oidc/revoke
End SessionGET/api/v1/oidc/end-session
RegistrationPOST/api/v1/oidc/register