WamISSO
WamISSO Identity platform
OAuth 2.0 identity provider

One identity.
Every authorized app.

WamISSO is the central identity provider for Department applications. Users sign in with Google. Developers register OAuth clients after approval.

Developer portal Documentation
OAuth 2.0 + PKCE OpenID Connect Google Sign-In
MCP server https://wamisso.rendovations.com/mcp How to connect

Works with your stack

Laravel Django Inertia Vue + API PHP Python JavaScript Dev guide

OAuth 2.0

Authorization code flow with OpenID Connect scopes.

Google

Sign in with any Google account. No passwords to manage.

Secure

Scoped tokens, revocation, and client registration controls.

Platform roles

Built for everyone in the ecosystem

WamISSO connects end users, application developers, and administrators through a single trusted identity layer.

End users

Sign in with your Google account. Passkeys add passwordless access across connected applications.

Developers

Register for an approved developer account, create OAuth clients, and integrate using guides for Laravel, Django, Vue, and more.

SSO admins

Review developer registrations, approve OAuth clients, and manage access from the admin console.

Authorization flow

How sign-in works

Your application redirects users to WamISSO, receives an authorization code, exchanges it for tokens, and fetches the user profile.

Developer onboarding

From registration to first login

Follow these steps to connect your application to WamISSO.

Register as a developer

Sign in at the developer portal with Google. New accounts start in pending status.

Wait for admin approval

An SSO admin reviews your registration and grants the developer role when approved.

Create an OAuth client

Register your app name and exact redirect URIs. Save the client_id and client_secret.

Integrate & test

Use the documentation to implement the authorize, token, and userinfo endpoints in your stack.

Developer registration guide Step-by-step instructions for signing up and getting approved. Integration overview OAuth endpoints, scopes, token exchange, and logout. Open developer portal Manage OAuth clients and view integration endpoints.
New AI agents · MCP

Let your AI coding agent do the setup

Connect Claude, Claude Code, Cursor or VS Code to WamISSO through the Model Context Protocol. Your agent registers your OAuth client and writes the sign-in code into your app, while you approve every change.

  1. Add the server URL Paste the WamISSO MCP URL into your agent: one command or a custom connector.
  2. Sign in to WamISSO Your browser opens WamISSO. Sign in with MFA and approve the agent. No tokens to copy.
  3. Ask in plain words The agent shows a preview of the client first. Nothing changes until you approve it. 
$ claude mcp add --transport http wamisso \
    https://wamisso.rendovations.com/mcp
  → signed in to WamISSO, access approved

you  Register "Inventory Dev" on WamISSO
     with callback http://localhost:3000/auth/callback

agent Preview: public client, PKCE, MFA required.
      Approve? yes
agent ✓ Client created, .env updated, login route added.
  • Only your own clients
  • Preview before every change
  • Prompt-injection checks
  • No deletes or secret rotation
  • Every call audited
MCP setup guide Connecting Claude, Claude Code, Cursor and VS Code, tools and guardrails. Manage connected agents Sign in to the developer portal and open AI Agents (MCP).
Security

Enterprise-grade protections

Identity controls designed for government systems and sensitive data.

Per-app multi-factor authentication Each app can require an authenticator code at sign-in. Enabled by default and recommended; admins and developers are always verified.
Passkeys (WebAuthn) Passwordless, phishing-resistant sign-in with device biometrics or a security key.
PKCE S256 enforced Browser and mobile apps must use the S256 code challenge, blocking authorization code interception.
Verified-email account linking Accounts merge by email only when the provider verifies it, so nobody can claim an address they do not own.
Rate limiting & lockout Throttled sign-in, MFA and OTP endpoints, with an automatic lockout after repeated failed codes.
Short-lived, revocable tokens Access tokens last 1 hour. Logout revokes access and refresh tokens, and hands off a signed, 2-minute browser sign-out.
Strict redirect URIs Exact-match callbacks, HTTPS with public hosts in live mode, and local-only addresses in testing mode.
Hardened sessions & CORS Secure, encrypted, HTTP-only cookies over HTTPS in production. CORS is limited to registered app origins, never a wildcard.
Approval workflow & audit trail Only admin-approved developers create OAuth clients, and role changes are logged.
Performance

Fast sign-in, light on your servers

Efficient by design, so single sign-on never becomes the bottleneck.

Lightweight token checks Apps validate a bearer token against a single small /api/user call, with no session state on their side.
Indexed lookups Users, social accounts, clients and token queries are backed by database indexes, including the admin reporting paths.
Cached overviews & metadata Admin dashboard figures refresh every minute and OAuth discovery metadata is cached for an hour.
Small front end About 46 KB of JavaScript and 60 KB of CSS, built with Vite, so sign-in pages load quickly.
Cached CORS origins Allowed browser origins are computed once and cached, not rebuilt on every token request.
Built to scale out Cache, session and queue drivers are configurable, so Redis and multiple app servers can be added as traffic grows.
API reference

Core endpoints

Base URL: https://wamisso.rendovations.com

Method Path Purpose
GET /oauth/authorize Start user sign-in and consent
POST /oauth/token Exchange authorization code or refresh token
GET /api/user Fetch authenticated user profile
POST /api/sso/logout Revoke the current access token
GET /.well-known/openid-configuration OpenID Connect discovery metadata
FAQ

Common questions

Who can register as a developer?

Anyone with a Google account can sign in at the developer portal. New registrations require approval from an SSO administrator before OAuth client creation is enabled.

Which OAuth flow should I use?

Use the Authorization Code flow with response_type=code. Server-side applications exchange the code for tokens using their client secret. See the framework guides for PKCE if you build a public client.

Where do I put my client secret?

Never expose the client secret in browser code or mobile apps. Keep it in server-side environment variables such as SSO_CLIENT_SECRET and perform token exchange on your backend.

How do I test sign-in locally?

Register a redirect URI that matches your local callback exactly (for example http://localhost:8001/auth/sso/callback), then follow the Laravel or plain PHP integration guide.

Ready to integrate?

Read the documentation, register as a developer, and connect your first application to WamISSO.

Read the docs Developer portal