Integrate your app

Every SDK starts the same way:

createCboxId({ issuer, clientId, redirectUri })

…and nothing in the SDK READMEs said where those three values come from. This page is that missing step. It takes about two minutes.

1. Sign in to the environment console

Open your environment's host — https://<tenant>.cboxid.com/admin — and sign in as an account member with admin access. If you have not created an environment yet, see Quickstart first.

Hosted environments live under cboxid.com, one subdomain per tenant. If you run Cbox ID yourself, substitute your own host everywhere this page writes <tenant>.cboxid.com; nothing else on the page changes.

The badge beside the environment name tells you which realm you are in. Register test integrations in a sandbox environment, not production: an environment is a hard isolation boundary with its own users, keys and issuer, so a client registered in one does not exist in the other.

2. Register the application

Applications → New application.

Two things that trip people up:

• Redirect URIs are matched exactly. https://app.example.com/callback and https://app.example.com/callback/ are different URIs. The one exception is a loopback address (http://127.0.0.1:PORT/…), where the port may differ from the one you registered — native apps bind an ephemeral port on each run (RFC 8252 §7.3).
• PKCE is required, and only S256 is accepted. Every SDK on this platform does it for you; if you are hand-rolling, plain will be refused.

3. Copy the credentials

On the application's page:

• Client ID — safe to ship in a browser bundle.
• Client secret — shown once, at creation. It is stored hashed, so it cannot be shown again; if you lose it, rotate it. Confidential clients only.

4. Find your issuer

Your issuer is your environment's own base URL. Confirm it — and everything else an SDK needs — from the discovery document:

curl https://<tenant>.cboxid.com/.well-known/openid-configuration

The issuer value in that response is exactly what you pass to the SDK. Use it verbatim: a conformant client compares it against the iss it receives and refuses a mismatch.

5. Point an SDK at it

npm install @cboxdk/id-js      # browser / Next.js
pip install cbox-id-client     # Python
composer require cboxdk/laravel-id-client

import { createCboxId } from '@cboxdk/id-js/nextjs';

export const cbox = createCboxId({
  issuer: 'https://acme.cboxid.com',
  clientId: 'cid_...',
  redirectUri: 'https://app.example.com/callback',
});

When it does not work

The token endpoint returns an RFC-shaped error, and for most failures an error_description that says what actually went wrong — read the description, not just the code.

Two codes are deliberately bare. invalid_client and unauthorized_client carry no description, because a description would tell an unauthenticated caller which half of a credential was wrong and turn the endpoint into a client-enumeration oracle. For those two, work from the table below rather than waiting for the server to explain itself.