Register an application

Create an OAuth client for your app — choose a client type, set redirect URIs and scopes, and get your credentials. This is step one for every integration.

Overview

Before your app can use “Sign in with NIA”, register it as an OAuth client. Registration gives you a client_id (and a client_secret for confidential apps), and records the redirect URIs and scopes your app is allowed to use.

You only register once per application per environment. Everything you configure here is what NIA checks on every authorization request.

Create a client

Sign in to the NIA dashboard and open Clients → New client.
Give it a name (shown to users on the consent screen) and, optionally, a logo and homepage URL.
Choose the client type (see below).
Add your redirect URI(s).
Select the allowed scopes — typically openid email profile (add offline_access for refresh tokens).
Save, then copy the client_id and client_secret — the secret is shown only once.

Point your framework's OIDC library at https://dev-api.niaauth.com and it will discover every endpoint automatically. Then follow your stack's guide under Integration.

Client types

The client type decides whether your app gets a secret and how tokens are exchanged. Pick it based on where the code runs.

Type	Use for	Secret?	How
Confidential	Server-rendered / backend apps — Next.js, Django, FastAPI, Spring, Express, Laravel, .NET, Go	Yes	Server exchanges the code with the secret
Public	SPAs & mobile — React, Vue, Angular, Flutter, Android, iOS	No	PKCE (S256) in the browser / app; token_endpoint_auth_method = none
Service	Machine-to-machine, no user	Yes	client_credentials grant

Public clients must never hold a client secret — it would be visible in the browser or app bundle. They rely entirely on PKCE.

Redirect URIs

NIA matches redirect URIs exactly — scheme, host, port and path must be identical, with no wildcards and no fragment. Register one URI per environment (dev, staging, prod).

The exact path depends on your framework:

Framework	Redirect URI path
Next.js (Auth.js)	`/api/auth/callback/nia`
React / Vue / Angular	`/callback`
Django / FastAPI / Flask / Express / Go / Laravel	`/auth/callback`
Spring Boot	`/login/oauth2/code/nia`
ASP.NET Core	`/signin-oidc`
Flutter / Android / iOS	`com.example.app:/oauth2redirect`

example

# Register both, exactly:
http://localhost:3000/auth/callback
https://app.example.com/auth/callback

redirect_uri_mismatch is the most common integration error — a trailing slash or wrong port will be rejected.

Scopes

Grant your client only the scopes it needs. The user consents to these the first time they sign in.

openid — required; issues an ID token.
email — the user's email + verification status.
profile — name, given/family name, picture.
offline_access — issues a refresh token for long-lived access.

See Protocol → Scopes & claims for exactly which claims each scope returns.

Credentials & rotation

The client_secret is shown once at creation — store it in your server's environment, never in source control or a browser bundle.
Load credentials from environment variables (NIA_CLIENT_ID, NIA_CLIENT_SECRET).
If a secret is ever exposed, rotate it in the dashboard — this issues a new secret and invalidates the old one.
Use separate clients for development and production so their secrets and redirect URIs stay isolated.

.env

NIA_ISSUER=https://dev-api.niaauth.com
NIA_CLIENT_ID=your-client-id
NIA_CLIENT_SECRET=your-client-secret   # confidential clients only