Identity

Chariot supports OpenID Connect (OIDC) on top of its OAuth 2.0 implementation. This allows your application to verify the identity of a nonprofit user during the authorization flow, enabling single sign-on (SSO) with Chariot.

How It Works

When your application includes the openid scope in the authorization request, the token response will include an id_token — a signed JWT containing identity claims about the authenticated user.

This works within the same Authorization Code Flow. No additional endpoints or flows are required.

Requesting Identity

Add the openid scope to your authorization request:

https://dashboard.givechariot.com/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://example.com/callback
  &response_type=code
  &scope=openid
  &state=RANDOM_CSRF_TOKEN
  &nonce=RANDOM_NONCE
  &code_challenge=YOUR_CODE_CHALLENGE
  &code_challenge_method=S256

The nonce is a cryptographically random string that your application generates. It is included in the ID token so you can verify the token was issued in response to your specific authorization request, preventing replay attacks.

1
const crypto = require("crypto");
2
3
function generateNonce() {
4
return crypto.randomBytes(32).toString("base64url");
5
}

The token response will then include an id_token alongside the access and refresh tokens:

1
{
2
  "access_token": "ACCESS_TOKEN",
3
  "refresh_token": "REFRESH_TOKEN",
4
  "id_token": "ID_TOKEN_JWT",
5
  "expires_in": 900,
6
  "token_type": "Bearer"
7
}

ID Token Claims

The id_token is a signed JWT containing standard OIDC claims:

Verifying ID Tokens

ID tokens are signed with Chariot’s private key. Verify them using the public keys from the JWKS endpoint:

GET https://api.givechariot.com/.well-known/jwks.json

Your JWT library should handle signature verification automatically given the JWKS URI. In addition, your application must validate:

• aud — Confirm the audience matches your client_id. This ensures the token was issued for your application and not another client.
• iss — Confirm the issuer matches Chariot’s auth server URL from the discovery endpoint.
• nonce — Confirm the nonce matches the value you sent in the authorization request. This prevents replay attacks.

UserInfo Endpoint

You can also fetch user identity on demand using the UserInfo endpoint with a valid access token:

$
curl https://api.givechariot.com/auth/oauth/userinfo \
>
  -H "Authorization: Bearer ACCESS_TOKEN"

Response:

1
{
2
  "sub": "user_abcd1234",
3
  "name": "Jane Doe",
4
  "given_name": "Jane",
5
  "family_name": "Doe",
6
  "email": "jane@example.com"
7
}

Discovery

Chariot publishes its OIDC configuration at the standard discovery endpoint:

GET https://api.givechariot.com/.well-known/openid-configuration

This returns the issuer, supported scopes, endpoint URLs, and signing key references needed to configure your OIDC client library.