Overview
Sign in with Paspo lets users sign in to your website with their Paspo ID account. Paspo is a standard OpenID Connect provider: your page gets a one-time authorization code, your server exchanges it for an id_token with the user's verified e-mail, phone or name.
Choose how to integrate
Paste one prompt into Claude Code, Cursor, Codex or Copilot and let the agent wire up the frontend and backend.
npm install @pingocean/paspo-sdk or a single <script> tag. Popup, PKCE, FedCM and fallbacks are handled for you.
Copy-paste examples for React, Next.js, Vue, Nuxt, Angular, Svelte and plain HTML.
No SDK: build the OAuth 2.0 + PKCE flow yourself or plug Paspo into Auth.js, openid-client and other OIDC libraries.
How it works
- The user clicks Sign in with Paspo on your page. The SDK generates
state,nonceand a PKCEcode_verifier. - A Paspo window opens at
https://paspo.id/oauth/authorize. The user scans a QR code with the Paspo app or confirms an existing session, and picks which e-mail / phone to share. - The window closes and your page receives a one-time
code(valid for 60 seconds). - Your page sends
codeandcode_verifierto your server. - Your server calls
POST https://paspo.id/api/w/v1/oauth/tokenwithclient_secret, verifies the returnedid_tokenand creates its own session.
In Chromium 141+, when you ask only for phone (no email), the SDK first shows the browser's own sign-in prompt (FedCM) — one tap for users already signed in to Paspo. If the browser blocks the popup, the SDK falls back to a full-page redirect.
Before you start
You need a registered OAuth client. Contact Support with:
| Redirect URIs | Exact URLs (no wildcards), e.g. https://app.example.com/auth/paspo/callback. Must be on the same origin as the page with the button. |
| Scopes | Any of openid, profile, email, phone. |
| Origins (optional) | https://app.example.com — needed for the FedCM prompt. |
| Name, logo, privacy policy, terms | Shown on the consent screen. |
You receive a public client_id (goes in the browser) and a client_secret (server only).
The code exchange always runs on your server. Never put client_secret in frontend code, environment variables prefixed with NEXT_PUBLIC_ / VITE_ / NUXT_PUBLIC_, or mobile apps.
Endpoints
| Issuer | https://paspo.id |
| Discovery | https://paspo.id/.well-known/openid-configuration |
| Authorize | https://paspo.id/oauth/authorize |
| Token | https://paspo.id/api/w/v1/oauth/token |
| JWKS | https://paspo.id/api/w/v1/oauth/jwks |
| UserInfo | https://paspo.id/api/w/v1/oauth/userinfo |
| SDK (CDN) | https://paspo.id/sdk/paspo.min.js |
Always prefer the values from the discovery document.
Next steps
- AI prompts — integrate with a coding agent.
- Installation — npm, pnpm, yarn, bun or CDN.
- Framework guides — React, Vue, Angular, Svelte and more.
- Server: exchange the code — Node.js, Python, PHP, Go.
- Reference — options, errors, claims.