SSO Integration Guide

Connect your application to WamISSO using OAuth 2.0 Authorization Code flow.

Base URL: https://wamisso.rendovations.com
Register as a developer at https://wamisso.rendovations.com/developer/login, get admin approval, then create an OAuth client in the developer portal to obtain a client_id (and a client_secret for server-side apps). See the developer registration guide for step-by-step instructions.

OAuth 2.0 flow

Endpoints

Method	Path	Description
GET	`/oauth/authorize`	Start login — redirect the user here
POST	`/oauth/token`	Exchange code or refresh token
GET	`/api/user`	User profile (requires Bearer token)
POST	`/api/sso/logout`	Revoke access token (requires Bearer token)
GET	`/.well-known/openid-configuration`	OpenID discovery metadata
GET	`/.well-known/oauth-authorization-server`	OAuth metadata

Authorization request

Redirect the browser to:

https://wamisso.rendovations.com/oauth/authorize
  ?client_id={CLIENT_ID}
  &redirect_uri={REDIRECT_URI}
  &response_type=code
  &scope=openid profile email
  &state={RANDOM_STATE}

Token exchange

curl -X POST https://wamisso.rendovations.com/oauth/token \
  -H "Accept: application/json" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "redirect_uri=http://localhost:3000/callback" \
  -d "code=AUTH_CODE_FROM_CALLBACK"

Client types

Type	Use for	Token exchange
Confidential	Server-side apps (Laravel, Django, Express, PHP)	`client_secret` sent from the backend. PKCE is optional but recommended.
Public	Browser SPAs and mobile apps	No secret. PKCE with `code_challenge_method=S256` is required; `plain` is rejected.

Public clients add code_challenge and code_challenge_method=S256 to the authorization request and send code_verifier instead of client_secret to /oauth/token. See the Browser SPA (PKCE) guide.

curl -X POST https://wamisso.rendovations.com/oauth/token \
  -H "Accept: application/json" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_PUBLIC_CLIENT_ID" \
  -d "redirect_uri=https://app.example.gov.ph/callback" \
  -d "code=AUTH_CODE_FROM_CALLBACK" \
  -d "code_verifier=ORIGINAL_CODE_VERIFIER"

User profile response

{
  "sub": "1",
  "name": "Juan Dela Cruz",
  "email": "user@wamisso.gov.ph",
  "email_verified": true
}

Scopes

Scope	Description
`openid`	Identity verification
`profile`	Name and basic profile
`email`	Email address

Global logout

When a user signs out, send the application's registered origin as post_logout_redirect_uri. WamISSO revokes both access and refresh tokens and returns a short-lived browser handoff that works with any framework:

curl -X POST https://wamisso.rendovations.com/api/sso/logout \
  -H "Accept: application/json" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  --data-urlencode "post_logout_redirect_uri=https://your-app.example.com"

{
  "message": "Successfully logged out",
  "status": "logged_out",
  "browser_logout_url": "https://wamisso.rendovations.com/sso/logout?expires=...&signature=..."
}

Always clear your local session or stored tokens even if the API call fails. When it succeeds, redirect the user's browser to browser_logout_url within two minutes; this clears the WamISSO browser session and returns to the registered application origin. Never construct this URL yourself.

Framework guides

Django — Python web framework
Laravel — server-side OAuth with sessions
Laravel + React Inertia — Laravel backend with React frontend
Vue + Laravel API — SPA frontend with Laravel API and Sanctum
Browser SPA (PKCE) — React / Vue / Angular sign-in without a backend or secret

Language guides

Developer registration — register, get approved, create OAuth clients
PHP integration — Laravel or plain PHP
Python integration — Flask / requests
JavaScript integration — Node.js / Express

Production: Use HTTPS, store secrets securely, never ship a client_secret to a browser or mobile app, and register exact redirect_uri values for each client.