Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Register Your Application

To integrate with Fabi-SC ID, you need to register your application in the Developer Dashboard.

Prerequisites

  1. A Fabi-SC ID account
  2. A domain you own and can verify

Creating an Application

  1. Log in to Fabi-SC ID
  2. Go to the Developer Dashboard
  3. Click “Create Application”
  4. Fill in the required information:

Required Fields

FieldDescription
NameYour application’s name (1-128 characters)
DomainThe domain where your application runs (e.g., example.com)
DescriptionA brief description of your application (at least 3 words, max 1024 characters)

Optional Fields

FieldDescription
Homepage URLYour application’s homepage
Privacy Policy URLURL to your privacy policy (shown to users during login)
Callback URLWhere users are redirected after login
Webhook URLURL to receive webhook notifications (must use a domain, no IP addresses)

Note: App Icon and Background Image are uploaded separately in the application settings after creation.

Domain Verification

Before your application can be used, you must verify ownership of your domain. This prevents others from impersonating your application.

Method 1: DNS TXT Record

  1. In your application settings, click “Verify Domain”
  2. Copy the verification token
  3. Add a TXT record to your domain’s DNS:
    fabi-sc-id-verify=<your-verification-token>
    
  4. Wait for DNS propagation (can take up to 24 hours)
  5. Click “Verify via DNS”

Method 2: HTTP File

  1. In your application settings, click “Verify Domain”
  2. Copy the verification token
  3. Create a file at: https://yourdomain.com/.well-known/fabi-sc-id-verification.txt
  4. The file should contain only the verification token (no extra whitespace)
  5. Click “Verify via HTTP”

Note: HTTP verification requires HTTPS. The file must be accessible via https://.

Credentials

After creating your application, you receive:

  • Client ID: Your application’s public identifier (shown as “ID” in settings)

API Keys

API Keys are created separately in your application settings. You can have multiple API keys per application.

To create an API key:

  1. Go to your application settings
  2. Scroll to the “API Keys” section
  3. Click “Create Key”
  4. Copy the key immediately - it won’t be shown again!

Important: Keep your API keys secret. If compromised, revoke them immediately. Consider rotating your keys periodically.

Webhook Secret

If you configure a webhook URL, you need to generate a webhook secret:

  1. Go to your application settings
  2. Scroll to the “Webhooks” section
  3. Click “Rotate Secret”
  4. Copy the secret immediately - it won’t be shown again!

Use this secret to verify that webhook requests are authentic. You can rotate the secret at any time.

Scopes

Scopes define what user data your application can access. Configure which scopes your application needs:

ScopeDescriptionData
openidUser identifierAlways included
usernameUsernameUser’s unique username
display_nameDisplay nameUser’s chosen display name
avatarProfile pictureURL to user’s avatar
localeLanguageUser’s preferred language
emailEmail addressUser’s email
email_verifiedEmail statusWhether email is verified
date_of_birthDate of birthUser’s birth date
first_nameFirst nameUser’s first name
last_nameLast nameUser’s last name
bioBiographyShort bio (max 160 chars)
website_linksWebsitesUser’s website URLs (max 5)
timezoneTimezoneUser’s IANA timezone

Required vs Optional Scopes

You can configure scopes as:

  • Required: User must grant these to use your application
  • Optional: User can choose whether to grant these

Users see all requested scopes during login and can toggle optional scopes.

Token Lifetime

Configure how long user tokens remain valid:

  • Days (0-365)
  • Hours (0-23)
  • Minutes (0-59)

Default is 1 day. After expiration, redirect users to the login page to get a new token.

Allowed Origins

Configure which origins can make API requests to fetch user data. At least one origin is required.

When you create an application, the default origin is set to https://yourdomain.com based on your configured domain.

Origins must:

  • Include the protocol (e.g., https://example.com)
  • Use a domain name (IP addresses are not allowed)