RadioCheck Integration

RadioCheck connects to Last1 ID for identity linking, credentials, and trust events.

Required flow (G3): OAuth + PKCE

Use the LastVet public-client template. Never put a GoTrue session in a redirect hash.

1. User taps Connect to Last1 ID in RadioCheck Profile
2. RadioCheck starts PKCE (S256) and opens:

https://auth.last1.id/oauth/authorize
  ?response_type=code
  &client_id=radiocheck
  &redirect_uri=radiocheck://last1-id/callback
  &scope=openid%20identity:read%20credentials:read%20app_links:read%20trust_events:write
  &state={state}
  &code_challenge={challenge}
  &code_challenge_method=S256

1. User signs in to Last1 ID (if needed) and grants consent
2. Last1 ID redirects to the exact registered redirect_uri with ?code=&state= only
3. RadioCheck exchanges code + code_verifier at POST /oauth/token
4. Store the scoped access/refresh tokens (Keychain). Identity is id_token.sub

Use @last1id/sdk-react-native (beginPkceFlow + completePkceFlow) or copy LastVet iOS Last1IDAuthManager.

MATR iOS and MATR Biz are the same template with client_id=matr-ios / matr-b2b and their registered native redirect URIs.

Legacy bridge (dual-run until both partners cut over)

Old builds may still open /authorize?app=radiocheck&app_user_id={userId}&redirect_uri=....

That path still creates identity_app_links + consent_grants and redirects with identity_id, app_user_id, linked=1.

It does not attach access_token or refresh_token to the hash. After both partners ship PKCE, retire /authorize?app= and POST /api/identity/authorize/intent|complete.

Configuration

Last1 ID

Registered RadioCheck redirect URIs (exact match):

• radiocheck://last1-id/callback
• radiocheck://callback
• HISTORICAL (deleted hosted): https://tcthzakppndkykatoefx.supabase.co/functions/v1/last1-id-callback

RadioCheck

• Issuer: https://auth.last1.id
• client_id: radiocheck (public client, PKCE required)
• Set EXPO_PUBLIC_LAST1_ID_URL for local IdP if needed

After Linking

• Scoped OAuth access token for userinfo / credentials / trust events
• RADIOCHECK_APP_SECRET remains for server-to-server ingest against an already-linked identity (G4 will shrink this; do not treat it as login)
• last1_identity_id / id_token.sub is the identity id

See:

• docs/OAUTH_OIDC_INTEGRATION.md
• docs/PARTNER_ONBOARDING_CHECKLIST.md
• packages/sdk-react-native/README.md