Authentication API

Connect with rNet is standard OAuth 2.0 (authorization code with PKCE) and OpenID Connect. Use these endpoints directly if there is no SDK for your language.

Authorize

Redirect the user's browser here to sign in and approve your app.

GEThttps://central-backend.rnetai.org/oauth2/authorize

Name	Description
`response_type` stringrequired	Always `code`.
`client_id` stringrequired	Your Client ID.
`redirect_uri` stringrequired	Must exactly match the redirect URI saved for your app.
`scope` stringrequired	`openid profile email`
`state` string	Random value you check on the callback. Strongly recommended.
`code_challenge` string	Base64url SHA-256 hash of your code verifier.
`code_challenge_method` string	`S256`

After the user approves, rNet redirects to redirect_uri?code=…&state=…. If they choose Cancel, the redirect carries error=access_denied instead.

Token

Exchange the code for tokens, or refresh an access token. Call this from your server.

POSThttps://central-backend.rnetai.org/oauth2/token

Send the body as application/x-www-form-urlencoded and authenticate with HTTP Basic using your Client ID and Client secret.

Name	Description
`grant_type` stringrequired	`authorization_code` or `refresh_token`
`code` string	The code from the callback (for `authorization_code`).
`redirect_uri` string	Same redirect URI as the authorize request (for `authorization_code`).
`code_verifier` string	The PKCE verifier you stored.
`refresh_token` string	The refresh token (for `refresh_token`).

bash

curl -X POST https://central-backend.rnetai.org/oauth2/token \
  -u "$RNET_CLIENT_ID:$RNET_CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code=AUTH_CODE \
  -d redirect_uri=https://yourapp.com/callback \
  -d code_verifier=VERIFIER

json

{
  "access_token": "eyJ...",
  "refresh_token": "...",
  "token_type": "Bearer",
  "expires_in": 1799,
  "scope": "openid profile email"
}

Lifetimes

Access tokens last 30 minutes; refresh tokens last 30 days. Each refresh returns a new refresh token. See Sessions and tokens.

User info

GEThttps://central-backend.rnetai.org/userinfo

Send the access token as Authorization: Bearer <access_token>.

json

{
  "sub": "user@example.com",
  "email": "user@example.com",
  "email_verified": true,
  "name": "Ada Lovelace",
  "preferred_username": "ada",
  "user_id": 42,
  "role": "USER",
  "status": "ACTIVE"
}

Values are examples; fields may vary by account.