Let players log in with their RSI identity

1. Read this page. No account needed.
2. Log in and create an app to mint a client_id. Applications are public and approved on submit.
3. Add a redirect URI (https://, or http://127.0.0.1 / localhost for local work).
4. Send the player to NAVCOM. They come back with a one-time code. You trade that code for tokens and call /oauth/v1/me.
5. Show their RSI handle. Optional avatar helper: /oauth/v1/citizens/{handle}/avatar.

Button pack (SVG + HTML, no tracking): SVG · HTML.

Public client libraries (clone these; login is only to mint a client_id):

• Python PKCE: github.com/Wild-Knight-Squadron/navcom-oidc-python — clone https://github.com/Wild-Knight-Squadron/navcom-oidc-python.git
• Passport: github.com/Wild-Knight-Squadron/passport-navcom — clone https://github.com/Wild-Knight-Squadron/passport-navcom.git
• Next / Electron notes (in-tree sample): /developers/samples/

Sandbox issuer: https://id-dev.navcom.ai (throwaway accounts only). The NAVCOM-ID Family portfolio.

• Verified RSI handle — the same identity NAVCOM-Bot already uses on Discord.
• No phone. No SMS. Discord, email, passkeys, optional TOTP.
• No Google login. No Twitch login.
• No client_credentials grant. No bulk machine client.
• Sandbox at id-dev.navcom.ai so you can try without production citizens.

• Authorization Code + PKCE S256 only (never plain). Default scopes: openid profile rsi.profile.
• There is no client_credentials helper. Do not add one.
• Discovery: /.well-known/openid-configuration
• Integrator OpenAPI: /oauth/openapi.json
• JWKS: /oauth/jwks.json
• Userinfo: GET /oauth/userinfo (bearer). Profile: GET /oauth/v1/me — sub + scoped claims.
• Orgs: GET /oauth/v1/me/orgs (bearer). Revoke: POST /oauth/revoke (RFC 7009). Introspect: POST /oauth/introspect (RFC 7662, confidential clients only).
• RP token revoke: POST /oauth/v1/apps/{client_id}/tokens/{token_id}/revoke (client secret).
• Refresh tokens rotate: store the new refresh_token; the previous one is dead.
• Token auth methods: client_secret_post, client_secret_basic, private_key_jwt, none (public PKCE).
• Scopes: openid (sub), profile (display name), rsi.profile/rsi (handle), orgs.primary (main org), orgs.public/orgs (public orgs), rsi:enlisted (enlisted date), email (verified email), discord (snowflake; discover toggle for reverse lookup).
• Avatar redirect: GET /oauth/v1/citizens/{handle}/avatar — public, no token, rate limited.
• Samples: /developers/samples/. Protocol notes also live on /docs#sign-in-with.

SENTRY-Web is the first live relying party. This page does not invent third-party RPs.

Log in to create an app

• NAVCOM-ID overview
• OpenAPI and integrator contract
• Protocol endpoints
• Scopes and claims
• Privacy, export, 2FA, Linked Roles
• Apply for a client