Migrating from a hosted auth provider

Use this if you want hosted sign-in and a user id, and you are ready to call CorroborateMe's API instead of your current provider's. Price is $5.99 a month or $55 a year. Pricing notes: hosted sign-in pricing compared.

What you leave behind

You do not keep the old SDK calls, hosted login templates, or rules that run inside the old provider during sign-in. Enterprise add-ons that most hosted auth providers sell separately are not part of this product.

Login link, the usual replacement for a hosted login

Create a login link

This call needs an active Pro plan. Without one it returns 402. POST /api/login-links with the company API key (aa_). Polling and server-sent events work with no extra setup. The default lifetime is 900 seconds.

curl -s -X POST https://corroborateme.com/api/login-links \
  -H "Authorization: Bearer aa_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"state":"job-42"}'

The response includes sessionId and loginUrl. Show loginUrl to the person. It opens the hosted sign-in page.

Read who signed in

curl -s https://corroborateme.com/api/login-links/SESSION_ID \
  -H "Authorization: Bearer aa_YOUR_KEY"

Replace SESSION_ID with sessionId from the create call. status is pending, completed, consumed, or expired. user_id (a cu_ id) and email are present after the person finishes, and null while the link is still pending.

To wait instead of polling, open GET /api/login-links/{id}/events. It streams for about 25 seconds and ends with a pending or done event.

OIDC, when several apps share one sign-in

POST /api/oidc/clients with name, redirect_uris, and public_client. A public client response includes clientId and does not include a secret. Then GET /api/auth/.well-known/openid-configuration and use the authorization_endpoint it returns, with the client id and a redirect URI you registered. JWKS is at /api/auth/jwks. Interactive login still uses the same hosted login-link page.

curl -s -X POST https://corroborateme.com/api/oidc/clients \
  -H "Authorization: Bearer aa_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"My app","redirect_uris":["https://app.example.com/callback"],"public_client":true}'

Take the authorize parameters from the discovery document.