Evantra

EVANTRA

Identity

Identity documentation

Identity documentation

Technical reference for building on Evantra Identity: endpoints, scopes, errors and integration rules.

Reference

Build with clarity, security, and explicit responsibility.

Evantra Identity is the authentication layer. Your application remains responsible for authorization, permissions and business-specific access control.

Identity web application

https://identity.evantradebuckman.com

Sign in, registration, verification and consent screens.

Identity API

https://evantra-headquarters.onrender.com

Authorization, token, userinfo, revoke and introspect endpoints.

API reference

Endpoints

GET/oauth/authorize
Request
client_id, redirect_uri, response_type=code, code_challenge, code_challenge_method=S256, scope, state, nonce
Returns
302 to redirect_uri with ?code= and ?state=
POST/oauth/token
Request
grant_type=authorization_code, code, redirect_uri, client_id, code_verifier
Returns
access_token, token_type, expires_in, refresh_token, id_token, scope
POST/oauth/token (refresh)
Request
grant_type=refresh_token, refresh_token, client_id
Returns
A new access_token and refresh_token
GET/oauth/userinfo
Request
Authorization: Bearer <access_token>
Returns
sub, evantra_id, email, email_verified, given_name, family_name, name
POST/oauth/revoke
Request
token, client_id
Returns
Empty body on success
POST/oauth/introspect
Request
token, client_id
Returns
active plus token metadata

Scopes

Request only what you need

openid

An ID token that identifies the user.

profile

Name and Evantra ID claims.

email

Contact email together with its verification status.

Scopes are space-separated. openid profile email is the default set and covers most integrations.

Errors

OAuth error codes

access_denied

The user declined consent.

Return them to your home page.

invalid_state

The returned state did not match the one you sent.

Discard the code and restart the flow.

invalid_grant

The authorization code expired or was already used.

Restart the flow.

invalid_client

client_id or client_secret was rejected.

Check your client configuration.

invalid_scope

A requested scope is not permitted.

Request only the scopes your client holds.

invalid_request

A required parameter was missing or malformed.

Review the request against the endpoint table.

Rules and regulations

  • Use Evantra Identity only for lawful, authorized access.
  • Register exact redirect URIs. There is no wildcard or prefix matching.
  • Identity authenticates users. Your application owns its own authorization and role checks.
  • Never store access tokens or session cookies in unsafe client storage.
  • Keep client secrets on servers. Public clients rely on PKCE alone.
  • Rotate client secrets on a schedule and immediately after any suspected exposure.
  • Verify email_verified before treating a contact address as trusted.

Why Evantra Identity

One identity everywhere

A single Evantra ID authenticates users across first-party and approved partner applications.

Standards-based

OAuth 2.0 Authorization Code with PKCE (RFC6749, RFC7636), plus RFC8252 redirect handling for native apps.

Hosted experience

Sign in, registration, consent and email verification are handled for you, so you never build an auth form.

Separated concerns

Identity handles authentication and consent. Your product keeps its own permissions, teams and business rules.

Controlled onboarding

Clients and redirect URIs are explicitly registered, which limits where authorization codes can travel.

Auditable

Sign-in, consent and client onboarding events are recorded for review.

Review channel

Feature requests, integration concerns and security suggestions can be submitted for Evantra workers to review.

Submit a suggestion

Integration code

Ready-to-use samples for web, mobile and server integrations, including the full PKCE and callback flow.

Open integration kit

Protected by Evantra Identity