Apps and single-page sites

No secret: PKCE protects the exchange. Web: the @unet/id-web SDK does it all, including token refresh.

const unet = new UnetId({ clientId, redirectUri, scopes: ["openid", "profile", "content:read"] });
      await unet.signIn();                            // redirects to unet.social
      const { user } = await unet.handleRedirectCallback();   // on your return URL
      const feed = await unet.api.feed();

Other platforms: the same flow by hand (below). Return URLs may be https://…, http://127.0.0.1:PORT/… or a custom scheme such as com.example.app:/callback.

# 1. PKCE
      verifier  = base64url(random 32 bytes)
      challenge = base64url(sha256(verifier))

      # 2. Open in the system browser
      GET https://api.unet.ovh/oidc/auth
        ?client_id=YOUR_APP_ID
        &redirect_uri=com.example.app:/callback
        &response_type=code
        &scope=openid%20profile%20offline_access
        &state=CSRF_TOKEN
        &code_challenge=CHALLENGE
        &code_challenge_method=S256

      # 3. Exchange the code (no client_secret)
      POST https://api.unet.ovh/oidc/token
      grant_type=authorization_code&code=…&redirect_uri=…&client_id=YOUR_APP_ID&code_verifier=VERIFIER

      # 4. Profile
      GET https://api.unet.ovh/oidc/me      Authorization: Bearer ACCESS_TOKEN