OAuth 2.0 & REST API Reference
Complete endpoint definitions, request headers, query parameters, JSON schemas, and response formats for Suloro Identity.
1. Authorization Endpoint (`GET /signin`)
The primary interactive OAuth authorization endpoint that renders the Suloro sign-in and consent interface.
Endpoint URL
GET https://accounts.suloro.com/signinQuery Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
client_id |
String | Yes | Your registered application Client ID. |
redirect_uri |
String | Yes | The exact URL where authentication results must be dispatched. |
platform |
String | Yes | Target platform: web or android. |
action |
String | Optional | Special action directives: check_session or logout. |
2. Account Chooser Endpoint (`GET /accountchooser`)
Renders the AES-GCM encrypted multi-account chooser interface for fast account switching.
Endpoint URL
GET https://accounts.suloro.com/accountchooserQuery Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
client_id |
String | Yes | Your registered application Client ID. |
redirect_uri |
String | Yes | Callback destination on your application domain. |
platform |
String | Yes | Must be web or android. |
3. User Claims Reference
The standard user profile claims object returned across Web callbacks and the Android SDK:
| Property | Type | Example | Description |
|---|---|---|---|
uid |
String | usr_7831f290ac |
Unique, immutable user identifier in Suloro. |
name |
String | Jane Doe |
Full display name of the authenticated user. |
email |
String | jane@example.com |
Verified primary email address associated with the account. |
gender |
String | Female / Male / Other |
User's declared gender profile attribute. |
dateOfBirth |
String (YYYY-MM-DD) | 1998-05-14 |
Cryptographically verified date of birth for age compliance. |
age |
Integer | 28 |
Calculated age in full years. |
photoUrl |
String (URL) | https://.../avatar.png |
Direct URL to the user's public avatar image. |
accessToken |
String | slr_tok_89ab32... |
Cryptographic session token for backend verification. |
4. Standard Error Codes
| Error Code | HTTP Status | Description |
|---|---|---|
UNTRUSTED_CLIENT |
400 Bad Request | Client ID does not match any registered application. |
REDIRECT_URI_MISMATCH |
400 Bad Request | The callback URI is not listed in registered redirect URIs. |
CROSS_PLATFORM_MISMATCH |
400 Bad Request | Attempted to use a Web Client ID on Android or vice-versa. |
UNVERIFIED_APP |
403 Forbidden | Application has not completed developer verification. |
ATTESTATION_FAILED |
403 Forbidden | Android SHA-256 certificate mismatch or failed hardware attestation. |
RATE_LIMITED |
429 Too Many Requests | Too many consecutive failed attempts from the requesting client IP. |