Tokens and sign-out

Checking a token later

Access tokens last one hour; add offline_access for a refresh token. If your backend wants to know whether a person still allows your app (they can remove it under Settings, Connected apps), ask the introspection endpoint. Removing the app deletes its tokens, so the answer turns to active: false at once. Only website apps (with a secret) can introspect, and only their own tokens. Cache answers for a short while: the token endpoints allow about 40 requests a minute per IP address.

# Is this access token still good? (your server → UNET, with your App ID and secret)
curl -u YOUR_APP_ID:YOUR_APP_SECRET \
  -d token=ACCESS_TOKEN \
  https://api.unet.ovh/oidc/token/introspection

# → { "active": true, "sub": "…", "scope": "openid profile", "client_id": "YOUR_APP_ID", "exp": 1700000000, … }
# → { "active": false }   expired, revoked, or not issued to your app

Being told when a person leaves

Set a Back-channel logout URL (https, on your own domain) in the app settings. UNET calls it when the person removes your app, signs out of UNET everywhere (password change, recovery) or signs out through UNET's end-session endpoint (https://api.unet.ovh/oidc/session/end). No browser involved, so it works when they never come back.

POST https://your-site.example/unet/logout        (the URL you registered)
Content-Type: application/x-www-form-urlencoded

logout_token=<JWT signed by UNET>

# Verify it like an ID token (signature from https://api.unet.ovh/oidc/jwks), then check:
#   iss = https://api.unet.ovh/oidc     aud = YOUR_APP_ID     no "nonce"
#   events has "http://schemas.openid.net/event/backchannel-logout"
# Its "sub" is the id your site knows for that person: end their sessions on your side.
# Answer 200 or 204 within 2 seconds.