Quickstarts

Any OIDC library

issuer:      https://accounts.u.cash
client_id:   (from the portal)
client_type: confidential -> client_secret_post or basic
             public (SPA / mobile) -> PKCE S256, no secret

next-auth (Auth.js)

import Providers from "next-auth/providers";
issuer: "https://accounts.u.cash",
clientId: process.env.U_CLIENT_ID,
clientSecret: process.env.U_CLIENT_SECRET,
authorization: { params: { scope: "openid email profile" } },
idToken: true   // the RS256 id_token carries the identity

For a browser-only app, register a public client and use the built-in PKCE flow with tokenEndpointAuthMethod: "none".

Passport (passport-oauth2)

passport.use(new OAuth2Strategy({
  authorizationURL: "https://accounts.u.cash/oauth2?op=authorize",
  tokenURL: "https://accounts.u.cash/oauth2?op=token",
  clientID: U_CLIENT_ID, clientSecret: U_CLIENT_SECRET,
  callbackURL: "https://yourapp.example/callback"
}, verify));

The reference RP (runnable)

A single-file PHP relying party with zero dependencies: discovery fetch, PKCE S256, state cookie, code exchange, id_token signature verification against the JWKS, userinfo rendering, and logout.

git clone https://git.u.cash/UdotCASH/signin-ref-rp.git
cd signin-ref-rp
php -S 127.0.0.1:8090 ref-rp.php
# open http://127.0.0.1:8090 and sign in

Register a public app in the portal with redirect URI http://127.0.0.1:8090/callback (loopback URIs need no domain verification), paste the client_id into the box on the RP home page, and click the button. That is the whole integration.