Your website.
One Cloudburg sign-in.
Let people sign in to your website with their Cloudburg account. Start with a registered app, explicit consent and a secure connection to your server.
Create and verify your account.
Choose a username and a reachable private contact email. Open the verification email, then sign in. Your username@cloudburg.org address is reserved; customer Cloudburg mailboxes do not yet send or receive mail. Developer ID identifies an account; it does not certify identity or professional skill.
Register your website.
Open Developer apps. Enter your app name and the exact HTTPS callback URL on a website you are authorized to configure. The server checks supported addresses; wildcards, URL fragments, localhost and private network addresses are not supported. Registration does not verify a brand or domain ownership.
Creating, changing or disabling an app requires your current password and a sign-in less than ten minutes old. The beta allows three app registrations per account, including disabled apps and unresolved creations. Disabling is permanent in this version.
Connect your server.
Copy the public client ID and configuration from your app’s integration panel. Public clients have no client secret. Use a maintained OpenID Connect library with the fixed issuer and discovery document below. Browser-only apps and cross-origin browser token exchange are not qualified in this beta.
For every attempt, generate fresh state, nonce and S256 PKCE values. Keep the verifier and a single-use transaction on your server, bound to the initiating browser. Exchange the returned code on your server using the exact registered callback. Keep tokens and verifiers out of URLs, HTML, logs and browser storage.
Validate response state and issuer, then the ID-token signature, issuer, audience, expiry and nonce. Match UserInfo sub to the validated ID-token sub. Identify accounts by the validated issuer and subject; do not automatically merge by email. Your website manages its own secure session and logout.
Choose permissions and test.
Begin with openid profile. The optional email scope shares the private external contact email and its verification status after consent. It does not share the reserved Cloudburg address. Identity scopes grant no access to mailboxes, files, File Wallet transfers, hardware, automation or billing.
To test your own app with Cloudburg Connect, register this exact callback:
https://connect.cloudburg.org/callback
Then use “Test this app with Cloudburg Connect” in your app’s integration panel. Review the app name, destination and permissions before allowing the connection. Connect keeps tokens on the server. If you create an account during a test, verify it first, then return to the requesting website and start a fresh sign-in.
Connection reference
- Discovery document
https://cloudburg.org/api/auth/.well-known/openid-configuration- Authorization endpoint
https://cloudburg.org/api/auth/oauth2/authorize- Token endpoint · server side
https://cloudburg.org/api/auth/oauth2/token- UserInfo endpoint · server side
https://cloudburg.org/api/auth/oauth2/userinfo- Public signing keys
https://cloudburg.org/api/auth/jwks- Client authentication
none- Code challenge method
S256
When access changes
App updates and disabling invalidate the app’s current Cloudburg grants, pending codes and consents. Already issued ID tokens may remain valid for up to five minutes. A relying website controls its own sessions and stored copies; changing an app does not automatically delete that data or end every website session.