Docs

1. 1

   Discovery: GET https://app.worktrust.io/.well-known/worktrust-connect names every address below.

2. 2

   Send the person to the authorise address with your client ID, a registered redirect URL, the scopes, a state and an S256 code challenge.

3. 3

   Exchange the code at the token address with your client ID and secret (Basic) and the code verifier. You receive an access key.

4. 4

   Read the passport with the key (Authorization: Bearer). Keep the answer, ask again after the time it names, verify its signature with the published keys.

Until your app is live, only your team's own WorkTrust accounts can approve it.

The person can disconnect your platform at any time; your key then reads nothing. Call the revoke address when a person leaves your platform.