Identity you can trust,
on every request.

# 1. Send the user to sign in
open "https://api.towly.ai/oauth2/auth?client_id=YOUR_CLIENT_ID&redirect_uri=https://yourapp.com/callback&response_type=code&scope=openid%20profile%20email"

# 2. Exchange the code (server side)
curl -X POST https://api.towly.ai/oauth2/token \
  -d grant_type=authorization_code \
  -d code=$CODE \
  -d redirect_uri=https://yourapp.com/callback \
  -u $CLIENT_ID:$CLIENT_SECRET

# 3. Verify the session
curl https://auth.towly.ai/sessions/whoami \
  -H "Authorization: Bearer $ACCESS_TOKEN"

// Verify the session from your backend
const res = await fetch("https://auth.towly.ai/sessions/whoami", {
  headers: { Authorization: `Bearer ${accessToken}` },
});
if (!res.ok) return redirect("https://id.towly.ai/login");

const session = await res.json();
console.log(session.identity.traits.email, session.authenticator_assurance_level);

import requests

tokens = requests.post("https://api.towly.ai/oauth2/token", data={
    "grant_type": "authorization_code",
    "code": code,
    "redirect_uri": "https://yourapp.com/callback",
}, auth=(CLIENT_ID, CLIENT_SECRET)).json()

session = requests.get("https://auth.towly.ai/sessions/whoami",
    headers={"Authorization": f"Bearer {tokens['access_token']}"}).json()