DEVELOPER PLATFORM

Noovex OAuth & API

Add Noovex sign-in to your OS or application. Each registered app gets one public API key (the OAuth client ID) and one private secret created by you.

1. Create your public API key

Checking your session…

2. Start Noovex OAuth

Open this URL in a new browser window when your user needs to sign in. No redirect URI setup is required — the public Noovex callback works for every app, and desktop clients can use a localhost port or urn:ietf:wg:oauth:2.0:oob.

GET https://mynexus.site/oauth/authorize
  ?client_id=nvx_xxxxxxxx
  &redirect_uri=https://mynexus.site/oauth/callback
  &response_type=code
  &scope=profile
  &state=<random>

After approval, Noovex redirects to your redirect_uri with ?code=…&state=…. The code is single-use and expires after five minutes.

3. Exchange the public key and secret

POST https://mynexus.site/api/public/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "<code from step 2>",
  "client_id": "nvx_xxxxxxxx",
  "client_secret": "<the secret you created>",
  "redirect_uri": "https://mynexus.site/oauth/callback"
}

→ 200 {
  "access_token": "nvxat_...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "profile"
}

4. Read the public profile

GET https://mynexus.site/api/public/oauth/userinfo
Authorization: Bearer nvxat_...

→ 200 {
  "sub": "<user id>",
  "username": "axel",
  "name": "Axel",
  "picture": null
}

Public and private values

The API key is the same value as your public client_id. It identifies your app and is safe to ship publicly.
The private secret is the value you create during registration. Noovex stores only its hash; keep the original in your secure server.
Never put the private secret in a browser bundle, installer, public repository, or downloadable OS package.
Redirect URIs are optional. Public callbacks — https://mynexus.site/oauth/callback, urn:ietf:wg:oauth:2.0:oob and http://localhost:PORT/… — work without setup, so your users do not need to configure anything. Custom URIs are matched exactly.
Access tokens expire after one hour. Always send a random state value and verify it on the callback.