Connect with hearthis.at

Let people sign in with their hearthis.at account on your site or in your app - in a popup, without a new password. With their permission, your app can also use the API on their behalf.

Documentation
  1. 1

    Register your app

    Name, return addresses and what it may ask for. You get a client ID and a secret.

  2. 2

    Add the button

    Our script opens the popup. Your server swaps the code for a token - OAuth 2.1 with PKCE.

  3. 3

    Test, then go live

    While testing, you and up to ten testers can connect. After our review, everybody can.

Quick start

On your page and on the return address you registered:

<script src="https://hearthis.at/_/javascripts/connect.js"></script>
<script>
  const hearthis = new HearthisConnect({
    clientId: "htc_…",
    redirectUri: "https://example.com/hearthis/callback",
    scope: "profile email"
  });
  const sendToServer = (result) => result && fetch("/hearthis/login", {method: "POST", body: JSON.stringify(result)});
  hearthis.redirectResult().then(sendToServer);
  button.addEventListener("click", () => hearthis.login().then(sendToServer));
</script>

<script>HearthisConnect.handleCallback();</script>

Your server then swaps the code for a token and asks who it is:

POST https://hearthis.at/oauth/token/
grant_type=authorization_code&code=…&code_verifier=…
&redirect_uri=…&client_id=htc_…&client_secret=hts_…

GET https://hearthis.at/oauth/userinfo/
Authorization: Bearer hta_…
Authorize
https://hearthis.at/oauth/authorize/
Token
POST https://hearthis.at/oauth/token/
Who is it
GET https://hearthis.at/oauth/userinfo/
Revoke
POST https://hearthis.at/oauth/revoke/
Discovery
https://hearthis.at/.well-known/oauth-authorization-server

Scopes: profile (always), email, read, social, write. Tokens go to api-v2.hearthis.at as "Authorization: Bearer". The full reference is part of the API documentation.