Sign in with NuvolaTXE (OIDC)

Any application can let its users sign in with their existing NuvolaTXE account, instead of building its own login system. This uses OpenID Connect (OIDC) — the same approach as "Sign in with Google" or "Sign in with Microsoft".

How it works

1. Your app registers itself in Tres (once) and receives a client_id and client_secret.
2. When a user clicks "Continue with NuvolaTXE", you redirect them to Tres.
3. The user logs in at Tres and is redirected back to your app with a temporary code.
4. Your app exchanges that code for an access_token (server-to-server).
5. Your app uses the access_token to fetch the user's email and name.

Your app never sees the user's NuvolaTXE password.

Step 1 — Register your app

Ask a NuvolaTXE admin to register your app under IAM (internal apps) or CIAM (customer-facing apps) in Tres, with:

App name

Redirect URI (e.g. https://yourapp.example.com/oauth_callback.php)

You receive a client_id and client_secret.

Step 2 — Add the login button

`html
<a href="https://tres.nuvolatxe.org/oauth/authorize.php?client_id=YOUR_CLIENT_ID&redirect_uri=https://yourapp.example.com/oauth_callback.php&state=RANDOM_STRING">
Continue with NuvolaTXE
</a>
`

Step 3 — Exchange the code for a token

`php
$ch = curl_init('https://tres.nuvolatxe.org/oauth/token.php');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'client_id' => 'YOUR_CLIENT_ID',
'client_secret' => 'YOUR_CLIENT_SECRET',
'code' => $_GET['code'],
]),
]);
$tokenResponse = json_decode(curl_exec($ch), true);
$accessToken = $tokenResponse['access_token'];
`

Step 4 — Fetch the user

`php
$ch = curl_init('https://tres.nuvolatxe.org/oauth/userinfo.php');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $accessToken],
]);
$userInfo = json_decode(curl_exec($ch), true);
// $userInfo['email'], $userInfo['name']
`

Notes

Authorization codes expire in 60 seconds — exchange immediately.

Access tokens expire after 1 hour.

Client secrets expire based on what you chose when registering (90 days to never).

If using Apache, make sure the Authorization header reaches PHP — add this .htaccess next to your callback:

`
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
`