LoopingBinary

LoopingBinary Auth

OAuth 2.0 Authorization Server

Developer Console
OAuth 2.0 Authorization Server

LoopingBinary OAuth API

Secure OAuth 2.0 authentication for third-party applications. Enable "Sign in with LoopingBinary" in your app.

Get StartedFull Documentation

Secure

OAuth 2.0 compliant with industry-standard security

Fast

Subdomain isolation for optimal performance

Isolated Sessions

No cookie conflicts with main application

Quick Start

1

Register Your Application

Go to Developer Console and create an OAuth client. You'll receive a client_id and client_secret.

Open Developer Console
2

Redirect Users to Authorization

Redirect users to https://auth.loopingbinary.com/oauth/authorize with your client ID and callback URL.

const authUrl = `https://auth.loopingbinary.com/oauth/authorize?
  client_id=${clientId}&
  redirect_uri=${encodeURIComponent(callbackUrl)}&
  response_type=code&
  scope=read profile&
  state=${randomState}`;

window.location.href = authUrl;
3

Exchange Code for Token

On your backend, exchange the authorization code for an access token. Never do this in frontend code!

// Backend only!
const response = await fetch('https://app.loopingbinary.com/api/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: authorizationCode,
    redirect_uri: callbackUrl,
    client_id: process.env.LB_CLIENT_ID,
    client_secret: process.env.LB_CLIENT_SECRET
  })
});

Authentication API

All authentication endpoints are hosted on auth.loopingbinary.com to ensure no CORS issues. These endpoints use the same database as the main application and automatically set cross-subdomain cookies for seamless authentication.

POSThttps://auth.loopingbinary.com/api/auth/login/init

Initiate passwordless login by sending a 6-digit code to user's email. All authentication endpoints are hosted on auth.loopingbinary.com to avoid CORS issues.

Request Body:

{
  "email": "user@example.com"
}

Response:

{
  "message": "Login code sent to your email",
  "emailSent": true,
  "expiresInMinutes": 10,
  "code": "123456"
}

Example:

fetch('https://auth.loopingbinary.com/api/auth/login/init', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // Important: include cookies
  body: JSON.stringify({
    email: 'user@example.com'
  })
})
POSThttps://auth.loopingbinary.com/api/auth/login/verify

Verify the 6-digit code and receive authentication token. Sets cross-subdomain cookie automatically.

Request Body:

{
  "email": "user@example.com",
  "code": "123456"
}

Response:

{
  "token": "jwt_token_here",
  "user": {
    "id": "user_uuid",
    "email": "user@example.com",
    "fullName": "John Doe",
    "role": "USER",
    "roles": [
      "USER"
    ],
    "status": "ACTIVE"
  }
}

Example:

fetch('https://auth.loopingbinary.com/api/auth/login/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // Important: include cookies
  body: JSON.stringify({
    email: 'user@example.com',
    code: '123456'
  })
})
POSThttps://auth.loopingbinary.com/api/auth/login/resend

Resend login code if user didn't receive it or it expired.

Request Body:

{
  "email": "user@example.com"
}

Response:

{
  "message": "Login code resent to your email",
  "emailSent": true
}

Example:

fetch('https://auth.loopingbinary.com/api/auth/login/resend', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({
    email: 'user@example.com'
  })
})
POSThttps://auth.loopingbinary.com/api/auth/register

Register a new user account (passwordless). Creates user and wallet automatically.

Request Body:

{
  "email": "user@example.com",
  "fullName": "John Doe",
  "role": "USER"
}

Response:

{
  "emailSent": true,
  "email": "user@example.com"
}

Example:

fetch('https://auth.loopingbinary.com/api/auth/register', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({
    email: 'user@example.com',
    fullName: 'John Doe'
  })
})

OAuth API Endpoints

OAuth authorization endpoints are on auth.loopingbinary.com, while token exchange and user info endpoints are on app.loopingbinary.com.

GEThttps://auth.loopingbinary.com/oauth/authorize

Authorization consent screen - redirect users here to start OAuth flow

Query Parameters:

client_id(string)*- Your OAuth client ID
redirect_uri(string)*- Your registered callback URL
response_type(string)*- Must be "code"
scope(string)- Space-separated scopes (e.g., "read profile")
state(string)- CSRF protection token

Example:

https://auth.loopingbinary.com/oauth/authorize?client_id=lb_xxx&redirect_uri=https://yourapp.com/callback&response_type=code&scope=read%20profile&state=xyz123
POSThttps://app.loopingbinary.com/api/oauth/token

Exchange authorization code for access token (call from your backend)

Request Body:

{
  "grant_type": "authorization_code",
  "code": "authorization_code_from_callback",
  "redirect_uri": "https://yourapp.com/callback",
  "client_id": "your_client_id",
  "client_secret": "your_client_secret"
}

Example:

fetch('https://app.loopingbinary.com/api/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: 'auth_code_here',
    redirect_uri: 'https://yourapp.com/callback',
    client_id: 'your_client_id',
    client_secret: 'your_client_secret'
  })
})
GEThttps://app.loopingbinary.com/api/oauth/userinfo

Get user information using access token

Headers:

{
  "Authorization": "Bearer {access_token}"
}

Example:

fetch('https://app.loopingbinary.com/api/oauth/userinfo', {
  headers: {
    'Authorization': 'Bearer your_access_token'
  }
})

Important Notes

  • • Authentication API: All auth endpoints (/api/auth/*) are on https://auth.loopingbinary.com - no CORS issues!
  • • OAuth Authorization: Use https://auth.loopingbinary.com for authorization flows
  • • Token Exchange: Use https://app.loopingbinary.com for token exchange and user info
  • • Cookies: Authentication tokens are automatically set as cross-subdomain cookies (.loopingbinary.com)
  • • Never expose your client_secret in frontend code
  • • Always validate the state parameter to prevent CSRF attacks
  • • Use HTTPS for all redirect URIs
  • • Include credentials: Always use credentials: 'include' in fetch requests to send cookies