SDK
MIX ID SDK packages cover browser authorization and backend token verification. SDK distributions are supplied separately from the identity service; package names below identify their import namespaces.
Browser
Section titled “Browser”@zorin/mix-browser provides MixBrowserClient. Configure issuer, clientId, redirectUri and scopes. Start signIn from the login action; call handleCallback only on the registered callback route. Redirect and popup flows differ: popup requires user activation and communication with its opener.
@zorin/mix-react integrates browser identity into React applications. Keep tokens out of logs and URLs; the browser client does not choose your application’s token persistence policy.
Backend
Section titled “Backend”@zorin/mix-node provides MixTokenVerifier and bearer parsing. Set issuer and audience, verify the access token, then require the operation’s scopes. An identity token does not authorize an API operation. Signature verification does not query current session revocation.
Trusted gateway
Section titled “Trusted gateway”Use gateway assertion helpers only behind an authenticated gateway. Validate audience, lifetime and replay policy in the receiving service; a forwarded HTTP header alone does not establish trust.
SDK methods and examples · OAuth flow · Application integration