Sign in with the hosted pages

// app.ts: a complete app that signs Carbons in with Silicon Accounts' hosted pages.
// Node 24+ runs TypeScript directly: ACCOUNTS_APP_ID=briefcase ACCOUNTS_APP_SECRET=sa_app_… node app.ts
import { createServer, type ServerResponse } from "node:http";
import { createHash, randomBytes } from "node:crypto";

const ACCOUNTS_URL = process.env.ACCOUNTS_URL ?? "https://accounts.teamofsilicons.com";
const APP_ID = process.env.ACCOUNTS_APP_ID ?? "briefcase";
const APP_SECRET = process.env.ACCOUNTS_APP_SECRET ?? ""; // sa_app_…: server side only, never in a page
const PORT = Number(process.env.PORT ?? 3000);
const REDIRECT_URI = `http://localhost:${PORT}/callback`; // registered in the app's redirect_uris

// state → the PKCE verifier of a sign-in this server started (use your session store in production).
const pending = new Map<string, { verifier: string; startedAt: number }>();
const random = (bytes: number) => randomBytes(bytes).toString("base64url");
const send = (res: ServerResponse, status: number, body: string) =>
  res.writeHead(status, { "Content-Type": "text/plain; charset=utf-8" }).end(body);

createServer(async (req, res) => {
  const url = new URL(req.url ?? "/", `http://localhost:${PORT}`);

  if (url.pathname === "/login") {
    const state = random(32);
    const verifier = random(32);
    pending.set(state, { verifier, startedAt: Date.now() });
    const authorize = new URL("/authorize", ACCOUNTS_URL);
    authorize.search = new URLSearchParams({
      app_id: APP_ID,
      redirect_uri: REDIRECT_URI,
      response_type: "code",
      scope: "email",
      state,
      code_challenge: createHash("sha256").update(verifier).digest("base64url"),
      code_challenge_method: "S256",
    }).toString();
    // The cookie binds the state to this browser, so a link someone else started can't sign it in.
    res.writeHead(302, {
      Location: authorize.toString(),
      "Set-Cookie": `signin_state=${state}; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600`,
    });
    return res.end();
  }

  if (url.pathname === "/callback") {
    const error = url.searchParams.get("error");
    if (error) return send(res, 400, `Sign-in ended without signing in: ${error} (${url.searchParams.get("error_description") ?? ""})`);
    const state = url.searchParams.get("state") ?? "";
    const cookieState = /(?:^|;\s*)signin_state=([^;]+)/.exec(req.headers.cookie ?? "")?.[1];
    const started = pending.get(state);
    pending.delete(state); // single use
    if (!started || cookieState !== state || Date.now() - started.startedAt > 60 * 60_000) {
      return send(res, 400, "This sign-in was not started in this browser (or it expired). Start again at /login.");
    }
    const response = await fetch(new URL("/v1/oauth/token", ACCOUNTS_URL), {
      method: "POST",
      headers: {
        Authorization: `Basic ${Buffer.from(`${APP_ID}:${APP_SECRET}`).toString("base64")}`,
        "Content-Type": "application/x-www-form-urlencoded",
      },
      body: new URLSearchParams({
        grant_type: "authorization_code",
        code: url.searchParams.get("code") ?? "",
        redirect_uri: REDIRECT_URI,
        code_verifier: started.verifier,
      }),
    });
    const tokens = await response.json();
    if (!response.ok) return send(res, 502, `Token exchange refused: ${tokens.error}: ${tokens.error_description}`);
    // Key your user record on tokens.account.uuid (permanent); tokens.account.id (c:…/si:…) can change.
    // Keep tokens.refresh_token server side: it rotates on every refresh.
    return send(res, 200, `Signed in as ${tokens.account.id} (${tokens.membership_id})\n${JSON.stringify(tokens.account, null, 2)}`);
  }

  res.writeHead(200, { "Content-Type": "text/html" }).end(`<a href="/login">Sign in</a>`);
}).listen(PORT, () => console.log(`Open http://localhost:${PORT}`));

Signed in as c:grace-hopper (briefcase:ptO)
{
  "uuid": "ptO",
  "membership_id": "briefcase:ptO",
  "kind": "carbon",
  "id": "c:grace-hopper",
  "display_name": "Grace Hopper",
  "pfp_url": "https://iris.teamofsilicons.com/pfp/carbon?id=ptO",
  "email": "grace.hopper@example.com",
  "email_verified": true,
  "updated_at": "2026-10-07T02:56:29.875Z",
  "version": 1
}

http://localhost:3000/callback?code=sac_KjpuMF137oQt0PoSfQ_fhS7IdoE64Cs600N9PcasFhc&state=EChNem4VPMzmIxr8frLfQf-CTjKqg8KzfPGVICgiu_U

http://localhost:3000/callback?error=access_denied&error_description=The+Carbon+declined+to+share+their+details+with+the+app.&state=91b7b09f9ef5dcd6470f7ff132a08777

curl -s -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" "$ACCOUNTS_URL/v1/oauth/token" \
  -d grant_type=authorization_code -d "code=$CODE" \
  -d redirect_uri=http://localhost:3000/callback -d "code_verifier=$CODE_VERIFIER"

silicon-accounts app token exchange --code "$CODE" --redirect-uri http://localhost:3000/callback --code-verifier "$CODE_VERIFIER"

Exchanged the code for c:grace-hopper (ptO).
access token   eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSIsImtpZCI6…
expires in     1800s
refresh token  sar_3tEv-OkGuQ6YLovqTGtzbvTAa-jlOCF7YVh7PJrsK3U
scope          profile email
membership     briefcase:ptO

silicon-accounts app config set - <<< '{"methods": {"google": true, "apple": true}}'

curl -s -X PATCH -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" \
  "$ACCOUNTS_URL/v1/apps/$ACCOUNTS_APP_ID/signin-config" -H 'Content-Type: application/json' \
  -d '{"methods": {"google": true},
       "google": {"mode": "byo", "client_id": "525053125706-….apps.googleusercontent.com", "client_secret": "GOCSPX-…"}}'

{
  "error": {
    "code": "validation_failed",
    "details": {
      "fields": {
        "apple.key_id": "is required when apple.mode is byo (10 characters, from your Apple developer account)",
        "apple.private_key": "is required when apple.mode is byo; send the .p8 key as {\"apple\":{\"private_key\":\"-----BEGIN PRIVATE KEY-----…\"}}",
        "apple.services_id": "is required when apple.mode is byo (your Services ID, e.g. com.example.signin)",
        "apple.team_id": "is required when apple.mode is byo (10 characters, from your Apple developer account)",
        "google.client_id": "is required when google.mode is byo (your Google OAuth client id)",
        "google.client_secret": "is required when google.mode is byo; send it as {\"google\":{\"client_secret\":\"…\"}}"
      }
    },
    "hint": "Fix the fields listed in details.fields and send the request again.",
    "message": "Invalid fields: …"
  }
}

# Cargo.toml
[dependencies]
silicon-accounts-client = { path = "/path/to/silicon-accounts/crates/client" }   # your checkout
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
url = "2"

//! Sign Carbons in to your app from Rust: hosted pages with state + PKCE, then exchange,
//! check, refresh and revoke. Run: ACCOUNTS_APP_ID=briefcase ACCOUNTS_APP_SECRET=sa_app_… cargo run
use std::collections::HashMap;

use silicon_accounts_client::{AuthorizeParams, Config, pkce_pair, random_state};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // ACCOUNTS_URL (default https://accounts.teamofsilicons.com), ACCOUNTS_APP_ID, ACCOUNTS_APP_SECRET.
    let config = Config::from_env()?;
    let client = config.client()?;
    let app = config.app_client(&client).ok_or("set ACCOUNTS_APP_ID and ACCOUNTS_APP_SECRET")?;
    let redirect_uri = "http://localhost:3000/callback"; // one of the app's redirect_uris

    // 1. Send the browser to the hosted pages. Keep `state` and `pkce.verifier` for the callback.
    let pkce = pkce_pair();
    let state = random_state();
    let url = client.authorize_url(
        &AuthorizeParams::new(app.app_id(), redirect_uri)
            .state(&state)
            .pkce(&pkce)
            .scopes(["email"]),
    );
    println!("Open this address, sign in, then paste the address you land on:\n{url}");

    // 2. The browser comes back to redirect_uri?code=…&state=… (or ?error=…&state=…).
    let mut line = String::new();
    std::io::stdin().read_line(&mut line)?;
    let back: HashMap<String, String> = url::Url::parse(line.trim())?.query_pairs().into_owned().collect();
    if let Some(error) = back.get("error") {
        return Err(format!("the sign-in ended without signing in: {error}").into());
    }
    if back.get("state") != Some(&state) {
        return Err("state does not match: this is not the sign-in this program started".into());
    }

    // 3. Exchange the code (single use, 2 minutes) with the PKCE verifier.
    let tokens = app.exchange_code(&back["code"], redirect_uri, Some(&pkce.verifier)).await?;
    let account = tokens.account.as_ref().ok_or("token responses carry the account")?;
    println!("signed in: {} (uuid {}, membership {})", account.id, account.uuid, account.membership_id);

    // 4. Check the access token: locally with the JWKS (fast), or ask the service (sees revocation).
    let jwks = client.jwks().await?;
    let claims = app.verify_access_token_locally(&jwks, tokens.access_token.expose())?;
    println!("local check: sub {} scopes {:?}", claims.sub, claims.scopes());
    let live = app.introspect(tokens.access_token.expose()).await?;
    println!("introspection: active {}", live.active);
    let info = app.userinfo(tokens.access_token.expose()).await?;
    println!("userinfo: {} {:?}", info.account.display_name, info.account.email);

    // 5. Refresh before the access token's 30 minutes run out; always keep the NEW refresh token.
    let old_refresh = tokens.refresh_token.as_ref().ok_or("no refresh token")?.expose().to_owned();
    let tokens = app.refresh(&old_refresh).await?;
    println!("refreshed: expires in {} s", tokens.expires_in);

    // 6. Sign the account out of your app: the whole sign-in ends.
    app.revoke(tokens.refresh_token.as_ref().ok_or("no refresh token")?.expose()).await?;
    let after = app.introspect(tokens.access_token.expose()).await?;
    println!("after revoke: active {}", after.active);
    Ok(())
}

Open this address, sign in, then paste the address you land on:
https://accounts.teamofsilicons.com/authorize?response_type=code&app_id=briefcase&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=kSj2dTMJ88E92lB_sXVv7mOHHasuEn5c&code_challenge=_Xwad6JJcE34Gs9gJVVlSABhLnAnsFCd6kYOXrAag5c&code_challenge_method=S256&scope=email
signed in: c:lin (uuid nln, membership briefcase:nln)
local check: sub nln scopes ["profile", "email"]
introspection: active true
userinfo: Lin Okafor Some("lin-docs@example.test")
refreshed: expires in 1800 s
after revoke: active false