Sign in with STX+

How it works

1. 1. Send the player to STX+

   Open https://stx.plus/authorize with response_type=code, your client_id, an https redirect_uri we have registered for you, scope=openid, a state value, and a PKCE code_challenge (S256 only). STX+ runs the face-or-fingerprint ceremony. Your app never sees it.

2. 2. Trade the code for tokens

   STX+ returns to your redirect_uri with a short-lived code. POST it to the token endpoint with your code_verifier. You get an ES256 id token, an access token, and a rotating refresh token. There is no client secret — PKCE is the proof.

3. 3. Verify, then trust

   Verify the id token signature against our published keys and check the issuer, audience, and expiry. The sub claim is the player's STX+ user id — the same id in every STX app. Use the access token to call userinfo and member-status.

Endpoints

• GET/api/partners/listings

  Retrieve your own private app submissions. Requires your signed-in STX+ session cookie on stx.plus; app access tokens do not grant access.

• POST/api/partners/listings

  Submit a private app listing. Send JSON with name, website (https), description and contactEmail from the same origin with your STX+ session cookie. Returns 201 and { listing }; GET returns { listings }. Submissions never enter the live directory automatically.

• GET/authorize

  Where you send players to sign in. Always on stx.plus — never host a sign-in screen yourself.

• POST/api/public/oauth/token

  Trade an authorization code for tokens, or a refresh token for a fresh set. Refresh tokens rotate; a reused one revokes the family.

• GET/api/public/oauth/userinfo

  The player's sub, and their email only while they are sharing it with your app.

• GET/api/public/oauth/member-status

  Live member facts for your app, including whether the player has a second sign-in device — required before any prize can land in their pass.

• GET/.well-known/jwks.json

  The public keys you verify our signatures with. Cache it; never hardcode a key.

• GET/.well-known/openid-configuration

  The discovery document, if your library prefers to configure itself.

The rules

• STX+ runs every sign-in ceremony. Your app never asks for a face, a fingerprint, or a password — it redirects and verifies.
• The sub claim is the player's STX+ user id, the same in every first-party app. Key your records to it; never to an email address.
• Email is shared only while the player says so. Re-read userinfo rather than storing a copy, so a revoked consent applies at once.
• Refresh tokens rotate on every use. Store the newest one; a reused token revokes the whole family and the player signs in again.
• Redirect addresses are exact-match and https-only. A retired app can no longer sign players in.
• Before anything of value lands in a player's pass, check member-status for a second sign-in device. No second device, no prize.