What is Suloro for Developers?

Suloro for Developers provides the official developer documentation, SDK libraries, and API specifications for integrating Sign in with Suloro into Web applications and Android apps.

Why should developers use Sign in with Suloro?

Suloro delivers instant, verified profile claims (name, email, gender, dob, avatar) with zero manual scope configuration, low-latency session checks, hardware-backed Android attestation, and a strict zero-ad-tracking privacy guarantee.

Does the Android SDK support Kotlin, Java, and Jetpack Compose?

Yes. The official Suloro Android SDK from dl.suloro.com/android includes complete first-class support for Kotlin (ViewBinding / XML), Java, and Jetpack Compose composables with SuloroAuthContract.

Do I need to declare manual scope queries in auth requests?

No. Suloro uses an automated Zero-Config Model. You only pass client_id, redirect_uri, and platform. Suloro provides the verified user attributes configured in your Developer Console registration automatically.

How does hardware attestation work in the Suloro Android SDK?

The Android SDK acquires a hardware-backed attestation token and verifies it against the Suloro Attestation Engine alongside the app's registered SHA-256 certificate fingerprint, rejecting modified or resigned APKs fail-closed.

Frequently Asked Questions (FAQ) — Suloro for Developers

1. General & Architecture

Suloro for Developers is the official developer portal providing tools, documentation, SDKs, and REST API specifications for integrating Sign in with Suloro into Web applications, mobile apps, and backend services.

Sign in with Suloro eliminates sign-up drop-off, password fatigue, and data breach risks. Users authenticate with 1 click across Suloro, while your application receives verified identity claims (name, email, gender, dob, photo) without manual form friction.

You do not need to construct manual scope strings like scope=name,email,gender. You only pass client_id, redirect_uri, and platform. Suloro automatically resolves the user profile attributes configured in your registered app permissions.

No. Suloro maintains a strict zero-advertising and zero-commercial-profiling guarantee. All authentication sessions and cryptographic tokens are strictly functional and security-oriented.

2. Web Integration

Popup Mode is recommended for modern web applications and Single Page Apps (SPAs) because it maintains your application's current scroll position and state while opening a focused 500x650 window that communicates via window.postMessage. Full Redirect mode is suitable for server-rendered multi-page apps.

When a user visits your web app, you can create a hidden iframe loading https://accounts.suloro.com/?action=check_session with your client ID. If the user is already logged in to Suloro Accounts, it immediately posts the session status back without opening any prompts.

Yes. Add http://localhost:3000/popup-callback.html (or your local port) to the Registered Redirect URIs in your Suloro Developer Console client settings. Note that browser security prevents ES modules on file:// URLs, so always run a local development server.

3. Android SDK

The official SDK is hosted at https://dl.suloro.com/android. Add maven { url = uri("https://dl.suloro.com/android") } to your settings.gradle.kts.

Yes. The SDK includes ready-to-use implementations for Kotlin (ViewBinding / XML), Java, and Jetpack Compose with the modern SuloroAuthContract.

The SDK requests a hardware-attested token from the device's secure enclave and matches it with the registered SHA-256 certificate fingerprint in the Developer Console. This blocks tampered APKs, repackaged clones, and rooted attack vectors before an authentication session is granted.

Run ./gradlew signingReport in your Android project terminal, or extract it from your keystore using keytool -list -v -keystore your_keystore.jks. Make sure to add both Debug and Release SHA-256 fingerprints to your Developer Console client.

4. Security & Tokens

All active authentication tokens, session cookies, and refresh tokens across all devices and linked third-party apps are invalidated instantly to prevent unauthorized access.

5. Error Troubleshooting

This occurs when the redirect_uri parameter sent in your authentication URL does not exactly match one of the URIs registered in the Suloro Developer Console. Check protocol (https://), port numbers, trailing slashes, and paths.

Suloro enforces strict platform isolation. If you use a Web Client ID inside the Android SDK or an Android Client ID on a website, the request is rejected. Create separate client credentials for each platform in the Developer Console.

The provided client_id was not found in the Suloro database, or the client application has been deleted or disabled. Double check your Client ID string in the Developer Console.