Sign-in providers

A project can enable Google, Apple, GitHub, and Microsoft sign-in. HALO owns the upstream callback exchange, while your application receives a short-lived one-time code at an allowlisted client callback.

#Project callback URL

https://api.agihalo.com/api/v1/auth/projects/{PROJECT_ID}/providers/{PROVIDER}/callback

#Supported providers

Save the client ID and secret in HALO, choose provider scopes, then enable sign-in. Stored secrets are encrypted and never returned.

#Browser + PKCE flow

// 1. Create an S256 PKCE verifier/challenge in your app.
const url = new URL(
  "https://api.agihalo.com/api/v1/auth/providers/google/authorize"
);

url.searchParams.set("apikey", HALO_PROJECT_PUBLISHABLE_KEY);
url.searchParams.set("redirect_to", "https://app.example.com/auth/callback");
url.searchParams.set("code_challenge", codeChallenge);
url.searchParams.set("code_challenge_method", "S256");
url.searchParams.set("state", clientState);

window.location.assign(url.toString());

1. 1
   Your app starts authorization

   Open the HALO provider authorize URL with the publishable key, allowlisted client callback, state, and S256 challenge.

2. 2
   HALO calls the provider

   HALO stores one-time state, sends the provider request, and receives the project-specific callback.

3. 3
   Your callback receives a code

   HALO redirects to the exact client callback with a short-lived code and your original state.

4. 4
   Your app exchanges the code

   Send the original verifier and redirect URL to receive the project user session.

#Security behavior

• Authorization and callback responses use no-store policies.
• Redirect URLs must match project configuration exactly.
• State and one-time codes are consumed once and expire.
• Unverified provider email and cross-project identity conflicts fail closed.