Legacy App-Link Compatibility Example

The /authorize?app= + authorize/complete bridge is dual-run and being retired. Do not start new integrations on it.

Path for new work

Use Authorization Code + PKCE against https://auth.last1.id:

1. Register an app client. Copy Client ID (UUID). The App ID slug is also accepted as client_id.
2. Redirect to https://auth.last1.id/oauth/authorize with PKCE S256.
3. Exchange the code at https://auth.last1.id/oauth/token.
4. Treat id_token.sub as the Last1 identity.

If you still have the bridge in production

Keep it only until that client ships PKCE. Then remove /authorize?app= and POST /api/identity/authorize/complete. Do not teach dual-run as the long-term strategy.