Skip to content

Last1 ID Partner Onboarding Checklist

1) Register App Client

  • Create an app client in Last1 ID:
  • Open App clients
  • Click Register app
  • Fill app ID/name and click Register
  • Record:
  • client_id: Copy Client ID (UUID). The App ID slug is also accepted on /oauth/authorize.
  • client_secret (confidential clients only; shown once after registration; store securely)
  • exact redirect_uris
  • allowed scopes
  • If secret is lost, use Regenerate client secret in App clients and replace the old value in your deployment environment.

2) Configure Environments

  • Use different clients for dev/staging/prod.
  • Ensure redirect URIs are environment-specific and exact.
  • Configure issuer URL as:
  • https://auth.last1.id
  • Confirm discovery and keys:
  • https://auth.last1.id/.well-known/openid-configuration
  • https://auth.last1.id/.well-known/jwks.json
  • Verify discovery issuer exactly matches https://auth.last1.id. Do not use https://last1.id (marketing HTML).

3) Implement Login Button

  • Add “Continue with Last1 ID”.
  • Use Authorization Code + PKCE:
  • create state, nonce, code_verifier, code_challenge
  • redirect to /oauth/authorize
  • exchange code at /oauth/token

4) Validate Tokens

  • Validate JWT issuer/audience/signature against jwks_uri.
  • Validate state and nonce.
  • Persist refresh tokens securely; never expose in client logs.
  • Expect RS256 signing with at least one key present in JWKS.
  • Request minimum scopes required.
  • Handle denied consent gracefully.
  • Support consent revocation states.

6) Data Portability Support

  • Provide users export/import controls where relevant.
  • Preserve signed bundle manifests.
  • Verify integrity hashes and signatures during import.

7) Security Controls

  • TLS-only callbacks.
  • No wildcard redirect URIs.
  • CSRF protection on callback handlers.
  • Replay protection for code/state/nonce.
  • Audit login and consent events.

8) Validation Checklist

  • Happy path login works on mobile and web.
  • Consent denied flow works.
  • Refresh token rotation works.
  • Token expiry/re-auth flows are graceful.
  • Accessibility checks pass:
  • keyboard navigation
  • visible focus
  • semantic error messages
  • screen reader labels