CohabitDeveloper Portal

Authentication

Cohabit Authentication is a standard OpenID Connect provider. Any OIDC-compliant library can integrate against it using the discovery document at:

https://auth.cohabit.com.au/.well-known/openid-configuration

Authorization code flow (with PKCE)

Use this when a person is logging in through your application — a website, a mobile app, or this developer portal itself.

  1. Redirect the user to the authorization_endpoint with your client_id, a redirect_uri registered on your project, response_type=code, and a PKCE code_challenge.
  2. The user logs in (or is already signed in) and, for third-party projects, approves the scopes your project requested.
  3. Cohabit Authentication redirects back to your redirect_uri with a code.
  4. Exchange the code at the token_endpoint, along with your code_verifier, for an access token, refresh token, and ID token.

PKCE is required for every project, including confidential clients — there's no way to opt out.

Client credentials flow

For server-to-server access with no end user involved, use the client_credentials grant against the token_endpoint with your project's client_id and client_secret. This is reserved for future server-to-server Cohabit API access — no product endpoints use it yet.

Scopes

  • openid — required for every request, confirms identity
  • email — read the user's email address
  • profile — read the user's name and profile photo
  • offline_access — issues a refresh token so you can stay signed in