Quickstarts

Each page takes one framework from an empty project to a person signed in through Cbox ID: register the app, install the SDK, set the environment, add the sign-in and callback routes, protect a page, sign out. Expect about ten minutes.

Pick your framework

Building a CLI instead? See Sign in from a CLI. For the reasoning behind each step, see Integrate your app.

Before you start

Every quickstart needs the same three things.

1. An environment. Cbox ID is organized as workspace → project → environment → organizations → users. Your app signs people in to one environment, and each environment is a hard boundary with its own users, keys and issuer. Use a sandbox environment while you follow a quickstart. If you do not have one yet, create a project and an environment from Projects in your workspace console. See Workspaces & organizations.

2. An application. Step 1 of every quickstart registers it, in the environment console, with the cbox CLI, or with the REST API. You come away with a client ID and, for a web app, a client secret that is shown once.

3. Its issuer. Each environment is its own issuer, on its own host: https://<environment>.cboxid.com on the hosted platform, or your own host if you run Cbox ID yourself. Confirm it with:

   curl https://<environment>.cboxid.com/.well-known/openid-configuration
   

   Use the issuer value from that response, character for character. The root host, cboxid.com, is not an identity provider: it answers 404 to discovery, and an SDK pointed at it fails before the first redirect.

The localhost redirect URIs

The quickstarts use the same redirect URI the console's Get started page registers for each framework, so an app created there works without editing:

Redirect URIs are matched exactly. When you deploy, register the production URI as well.