End users
Sign in with your Google account. Passkeys add passwordless access across connected applications.
One identity.
Every authorized app.
WamISSO is the central identity provider for Department applications. Users sign in with Google. Developers register OAuth clients after approval.
OAuth 2.0 + PKCE
OpenID Connect
Google Sign-In
OAuth 2.0
Authorization code flow with OpenID Connect scopes.
Sign in with any Google account. No passwords to manage.
Secure
Scoped tokens, revocation, and client registration controls.
Platform roles
Built for everyone in the ecosystem
WamISSO connects end users, application developers, and administrators through a single trusted identity layer.
Developers
Register for an approved developer account, create OAuth clients, and integrate using guides for Laravel, Django, Vue, and more.
SSO admins
Review developer registrations, approve OAuth clients, and manage access from the admin console.
Authorization flow
How sign-in works
Your application redirects users to WamISSO, receives an authorization code, exchanges it for tokens, and fetches the user profile.
Developer onboarding
From registration to first login
Follow these steps to connect your application to WamISSO.
Register as a developer
Sign in at the developer portal with Google. New accounts start in pending status.
Wait for admin approval
An SSO admin reviews your registration and grants the developer role when approved.
Create an OAuth client
Register your app name and exact redirect URIs. Save the client_id and client_secret.
Integrate & test
Use the documentation to implement the authorize, token, and userinfo endpoints in your stack.
Security
Enterprise-grade protections
Identity controls designed for government systems and sensitive data.
Multi-factor authentication
Verified Google identity with optional passkeys for high-assurance sign-in.
Passkey support
Passwordless sign-in with WebAuthn for supported accounts.
Token revocation
Revoke access tokens on logout so sessions cannot be reused.
Scoped access
Request only the OpenID scopes your application needs: openid, profile, email.
Google account sync
Profiles created from your Google name and email, with admin-controlled developer registration.
Client approval workflow
OAuth clients are created only by approved developers under admin oversight.
API reference
Core endpoints
Base URL: https://wamisso.rendovations.com
| Method | Path | Purpose |
|---|---|---|
| GET | /oauth/authorize |
Start user sign-in and consent |
| POST | /oauth/token |
Exchange authorization code or refresh token |
| GET | /api/user |
Fetch authenticated user profile |
| POST | /api/sso/logout |
Revoke the current access token |
| GET | /.well-known/openid-configuration |
OpenID Connect discovery metadata |
FAQ
Common questions
Who can register as a developer?
Anyone with a Google account can sign in at the developer portal. New registrations require approval from an SSO administrator before OAuth client creation is enabled.
Which OAuth flow should I use?
Use the Authorization Code flow with response_type=code. Server-side applications exchange the code for tokens using their client secret. See the framework guides for PKCE if you build a public client.
Where do I put my client secret?
Never expose the client secret in browser code or mobile apps. Keep it in server-side environment variables such as SSO_CLIENT_SECRET and perform token exchange on your backend.
How do I test sign-in locally?
Register a redirect URI that matches your local callback exactly (for example http://localhost:8001/auth/sso/callback), then follow the Laravel or plain PHP integration guide.
Ready to integrate?
Read the documentation, register as a developer, and connect your first application to WamISSO.