Secure Identity
One identity.
Every Evantra
experience.
Your Evantra ID provides secure access across the Evantra digital ecosystem.
EVANTRA IDENTITY
Unified Auth & Enterprise SSO
Developer integration
Developer integration
Integrate Evantra Identity into web, mobile and desktop applications using OAuth 2.0 with PKCE.
Integration path
Keep identity simple. Keep authorization in your app.
Evantra Identity provides authentication, consent and session management through the OAuth 2.0 Authorization Code flow with PKCE. Your application keeps ownership of its own permissions, teams and product-specific access logic.
Flow
Authorization code + PKCE
Standards
RFC6749 · RFC7636 · RFC8252
Redirect targets
Web · Native · Loopback
1. Register your OAuth client
Create an application in the Evantra workspace. You receive a public client_id, and a client_secret only if your application is confidential.
Confidential clients run on a server. Web front ends, mobile apps and desktop apps are public clients and must never hold a secret.
2. Register exact redirect URIs
Redirect URIs are matched exactly. There are no wildcards and no prefix matching.
Web: https://app.example.com/oauth/callback · Native: com.example.app://oauth/callback · Loopback: http://127.0.0.1:PORT/callback
3. Send the user to /oauth/authorize
Point the browser or system web view at the authorization endpoint with your PKCE challenge and state.
If the visitor has no Evantra session, the identity service walks them through sign in — and registration and email verification when needed — then returns them to your exact authorize request.
4. Exchange the code for tokens
POST the authorization code and your PKCE verifier to /oauth/token, then load the profile from /oauth/userinfo.
Exchange the code on your backend when your client is confidential. The code is single-use and expires quickly.
5. Manage the session lifecycle
Use refresh, revoke and userinfo from your backend, and keep your own session aligned with Evantra's httpOnly cookie.
Revoke tokens on sign-out. Never persist an access token in localStorage.
Redirect targets
Where the authorization code is delivered
Web
https://app.example.com/oauth/callbackYour callback route reads ?code= from the URL.
Native (iOS / Android / Expo)
com.example.app://oauth/callbackThe OS opens a deep link into your app. Read the code from the incoming URL.
Desktop / CLI (loopback)
http://127.0.0.1:53682/callbackA temporary local listener receives the code. Use a random port and bind to 127.0.0.1 only.
HTTPS is required for every non-loopback web URI. Plain http is accepted only on localhost, 127.0.0.1 or ::1. Fragments are rejected on all redirect URIs.
Registration and email verification
You do not build a sign-up form.
When a visitor with no Evantra ID reaches your authorization request, Evantra Identity handles registration, sends the verification email, and keeps your authorization request alive the whole time. After the contact email is confirmed the same request resumes and the authorization code is issued.
On mobile, the verification link opens in the user's mail browser rather than your app. Registering a loopback redirect URI lets you complete verification without depending on the mail client handing control back.
Integration checklist
- Always use PKCE with the S256 challenge method.
- Always send state and verify it when the code comes back.
- Never embed a client_secret in a browser or mobile app.
- Exchange the authorization code before it expires — it is single use.
- Keep refresh tokens in secure storage or on your server.
- Check email_verified before trusting a contact address.
- Keep your own authorization and role checks in your application.
Submission and support
Share integration feedback, missing endpoints or workflow suggestions so Evantra workers can improve the identity platform.
Protected by Evantra Identity