> ## Documentation Index
> Fetch the complete documentation index at: https://help.lobyco.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up Lobyco IDP for your website(s)

> Use Lobyco as the identity provider for your own websites.

This page describes how to integrate the Lobyco Member Management scope into your existing website(s).

This page is relevant to you if **you are using Lobyco Member Management** for storing your membership data and using **Lobyco Identity Provider** (IDP) for Sign-in, Sign-up and customers' membership profile.

Lobyco's Member Management includes customers **sign-in, sign-up and MyProfile** pages.

These are web-based and are being used in your Lobyco white label app as well as they can be integrated on your existing cooperate website, online shopping site etc.

Lobyco Identity supports OAuth 2.0 Authorization Code Flow with PKCE for secure authentication and token management. External or public web applications (e.g. SPAs) can integrate using this standard flow to authenticate users and call Lobyco APIs without exposing a client secret.

It is strongly recommended to use a standard OAuth 2.0 / OIDC client library provided for your front-end framework.\
These libraries handle PKCE generation, redirects, token storage, and silent renewals automatically.

## Prerequisites

Reach out to Lobyco to register the website as a public OAuth client in Lobyco Identity solution.\
The following details must be provided during registration:

* Client name (application name)
* Redirect URIs — the exact URLs where users are redirected after authentication (for example [https://example.com](https://example.com/))

You will receive:

* IDENTITY\_BASE\_URL
* CLIENT\_ID

## Integration Steps

<Steps>
  <Step>
    ### Redirect the User to the Authorization Endpoint

    ```http theme={"system"}
    GET {IDENTITY_BASE_URL}/oauth2/auth
    ?client_id={CLIENT_ID}
    &response_type=code
    &audience={AUDIENCE_1}+{AUDIENCE_2}
    &redirect_uri={CLIENT_REDIRECT_URI}
    &scope={SCOPE_1}+{SCOPE_2}
    &state={STATE_VALUE}
    &nonce={NONCE_VALUE}
    &code_challenge={CODE_CHALLENGE}  
    &code_challenge_method=S256
    ```

    The user authenticates and authorizes the application. Lobyco Identity redirects back to your specified redirect\_uri with an authorization code.
  </Step>

  <Step>
    ### Exchange the Authorization Code for Tokens

    ```http theme={"system"}
    POST {IDENTITY_BASE_URL}/oauth2/token
    Content-Type: application/x-www-form-urlencoded

    grant_type=authorization_code
    code={AUTHORIZATION_CODE}
    redirect_uri={REDIRECT_URI}
    client_id={CLIENT_ID}
    code_verifier={CODE_VERIFIER}
    ```

    The response includes:

    * access\_token — for accessing Lobyco APIs
    * id\_token — containing user identity information (if OIDC enabled)
    * refresh\_token — for renewing tokens (if allowed)
  </Step>

  <Step>
    ### Use the Access Token in API Requests

    `Authorization: Bearer {ACCESS_TOKEN}`

    When validating tokens on the back end, choose the correct validation method depending on the token type:

    * `JWT access tokens:` validate locally using the issuer’s jwks\_uri.
    * `Opaque access tokens:` call the introspection endpoint (for example /oauth2/introspect)
  </Step>
</Steps>

## Scopes required for Sign-in and Sign-up pages

* openid
* offline\_access

## Scopes required for MyProfile web page

* openid
* offline\_access
* profile
* profile.edit