You create an app for Log in with Congressus yourself, in Congressus Manager.
Go to Settings > Apps and, under OAuth2, click the Add OAuth2 app button.
Under App, fill in a Name and a Description. Members see them when they give your app permission.
Under Sign-in, fill in:
Redirect URIs: where the member goes after logging in, one per line and exactly as your application sends it. A URI starts with https, with your app's own scheme (such as
myapp://), or with http onlocalhost. The first is used when your application names none.Client type: Confidential for a server that can keep a secret, or Public for a mobile or browser app. A public app gets no client secret, must use PKCE and gets no refresh tokens.
Sign-in standard: OpenID Connect for a new app. Legacy is how apps from before OpenID Connect sign in. The difference is explained in Log in with Congressus via OpenID Connect.
Under Settings, fill in:
Access token validity: how many seconds an access token is valid. 240 by default.
Allow refresh tokens: your application can then fetch a new access token itself, without the member logging in again. A public app never gets refresh tokens.
Allow silent grants: a member who gave your app permission before for the same or more scopes doesn't have to click Grant again. When your app asks for a scope the member hasn't given yet, we ask the member again.
Under Access, choose in Maximal access scope which scopes your app may ask for. A new app may only ask for
openid. Which details each scope gives is explained in Which scopes are available?Click Add oauth app.
Then open your app in the list. Credentials shows:
Client ID: this is how we recognise your app.
Client secret: the server of a confidential app authenticates with it. A public app has none.
For an app on OpenID Connect, the Issuer and Discovery URL of each website are shown on the right.
Note! Your client secret must always stay secret. Never put it in a mobile app or browser app (javascript). Choose the Public client type for such an app.
Blocking an app temporarily
Under Access, tick Locked. Members can then no longer log in through your app, and tokens already issued stop working until you untick it.
Never asking members for permission
Should members never have to give your app permission, for instance because it is the association's own app? We only switch that on in exceptional cases, in consultation with Support.