OAuth 2.1, OIDC, and passkeys —
drop into any stack.

app.get("/auth/callback", async (req, res) => {
  const { code, state } = req.query;

  // Verify state matches what you stored before redirect
  if (state !== req.session.oauthState) {
    return res.status(400).send("Invalid state parameter");
  }

  // Step 4: Exchange code for tokens (server-to-server)
  const tokenRes = await fetch("https://identity.wenme.net/oauth/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: "https://yourapp.com/auth/callback",
      client_id: process.env.WENME_CLIENT_ID,
      client_secret: process.env.WENME_CLIENT_SECRET,
      code_verifier: req.session.codeVerifier,  // PKCE
    }),
  });
  const tokens = await tokenRes.json();

  // Step 5: Get user info from Wenme (one-time call)
  const userRes = await fetch("https://identity.wenme.net/oauth/userinfo", {
    headers: { Authorization: `Bearer ${tokens.access_token}` },
  });
  const wenmeUser = await userRes.json();
  // wenmeUser = { sub: "uuid", name: "Alice", email: "[email protected]", picture: "..." }

  // ============================================
  // STEP 6: CREATE YOUR OWN SESSION
  // This is YOUR app's responsibility from here
  // ============================================

  // Find or create user in YOUR database
  let user = await db.users.findByEmail(wenmeUser.email);
  if (!user) {
    user = await db.users.create({
      wenmeId: wenmeUser.sub,
      email: wenmeUser.email,
      name: wenmeUser.name,
      avatar: wenmeUser.picture,
    });
  }

  // Create YOUR app's session (cookie, JWT, whatever you prefer)
  req.session.userId = user.id;
  req.session.email = user.email;

  // Store tokens if you need to call Wenme userinfo later
  // (optional — most apps don't need this)
  req.session.wenmeAccessToken = tokens.access_token;
  req.session.wenmeRefreshToken = tokens.refresh_token;

  // Redirect to your app — Wenme is no longer involved
  res.redirect("/dashboard");
});

[HttpGet("callback")]
public async Task<IActionResult> Callback(string code, string state)
{
    // Verify state
    if (state != HttpContext.Session.GetString("oauth_state"))
        return BadRequest("Invalid state parameter");

    // Exchange code for tokens
    var tokens = await _wenmeAuth.ExchangeCodeAsync(code);

    // Get user info from Wenme (one-time)
    var wenmeUser = await _wenmeAuth.GetUserInfoAsync(tokens.AccessToken);

    // =============================================
    // CREATE YOUR OWN SESSION — Wenme is done here
    // =============================================
    var user = await _userService.FindOrCreateAsync(new {
        WenmeId = wenmeUser.Sub,
        Email = wenmeUser.Email,
        Name = wenmeUser.Name
    });

    // Set YOUR app's auth cookie
    var claims = new List<Claim> {
        new(ClaimTypes.NameIdentifier, user.Id.ToString()),
        new(ClaimTypes.Email, user.Email),
        new(ClaimTypes.Name, user.Name),
    };
    var identity = new ClaimsIdentity(claims, "WenmeAuth");
    await HttpContext.SignInAsync(new ClaimsPrincipal(identity));

    return Redirect("/dashboard");
}

User clicks "Sign in with Wenme"
    │
    ▼
Wenme authenticates → returns user identity
    │  sub: "user-uuid-123"
    │  email: "[email protected]"
    │  name: "Alice"
    │
    ▼
Your app creates its own session (see Session Management above)
    │
    ▼
User tries to perform an action (e.g. delete an invoice)
    │
    ▼
Your app calls Darwan:
    POST https://darwan.net/v1/authorize
    {
      "tenantId":     "your-org-uuid",
      "principalId":  "user-uuid-123",    ← same ID from Wenme's "sub"
      "action":       "delete",
      "resourceType": "invoice",
      "resourceId":   "inv-001"
    }
    │
    ▼
Darwan responds: { "allowed": true, "reason": "RBAC grant matched" }
    │
    ▼
Your app allows or denies the action

// In your OAuth callback, after getting user info from Wenme
const wenmeUser = await wenme.getUserInfo(accessToken);
// wenmeUser.sub = "user-uuid-123"

// Assign role in Darwan (first login or role change)
await fetch("https://darwan.net/v1/assignments/principal-role", {
  method: "POST",
  headers: {
    "Authorization": "Bearer dk_live_YOUR_DARWAN_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    tenantId: "your-org-uuid",
    principalId: wenmeUser.sub,   // Wenme user ID = Darwan principal
    roleId: "role-viewer-uuid",   // Role you defined in Darwan
  }),
});

// Middleware or helper function
async function checkPermission(userId, action, resourceType, resourceId) {
  const res = await fetch("https://darwan.net/v1/authorize", {
    method: "POST",
    headers: {
      "Authorization": "Bearer dk_live_YOUR_DARWAN_KEY",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      tenantId: "your-org-uuid",
      principalId: userId,     // From your session (originally from Wenme's sub)
      action,
      resourceType,
      resourceId,
    }),
  });
  const decision = await res.json();
  return decision.allowed;
}

// Usage in your API route
app.delete("/api/invoices/:id", async (req, res) => {
  const allowed = await checkPermission(
    req.session.userId,  // Wenme's sub, stored in your session
    "delete",
    "invoice",
    req.params.id
  );

  if (!allowed) return res.status(403).json({ error: "Forbidden" });

  await db.invoices.delete(req.params.id);
  res.json({ success: true });
});

// 1. Admin sends invitation via Wenme
await fetch("https://identity.wenme.net/api/app/invite", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: "your_client_id",
    client_secret: "your_client_secret",
    email: "[email protected]",
    role: "editor",
    redirect_url: `https://yourapp.com/dashboard?invitationId=${invitationId}`,
  }),
});

// 2. In your OAuth callback, after Wenme authenticates the user
app.get("/auth/callback", async (req, res) => {
  const { code, state } = req.query;
  const invitationId = req.query.invitationId;  // From redirect URL

  // ... exchange code, get Wenme user info ...

  // Map invitation role to Darwan role
  if (invitationId) {
    const invitation = await db.invitations.findById(invitationId);
    if (invitation && invitation.email === wenmeUser.email) {
      const darwanRoleId = mapRoleToDarwan(invitation.role);
      // e.g. "editor" → "role-editor-uuid"

      await assignDarwanRole(wenmeUser.sub, darwanRoleId);
      await db.invitations.markAccepted(invitationId);
    }
  }

  // Create session and redirect
  req.session.userId = wenmeUser.sub;
  res.redirect("/dashboard");
});

wm_pk_<32 random hex characters>

Example: wm_pk_ab1234567890abcdef1234567890abcd

curl -X POST https://identity.wenme.net/api/tenant/invite \
  -H "Authorization: Bearer wm_pk_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tenant_id": "your-organization-uuid",
    "email": "[email protected]",
    "role": "member"
  }'

const response = await fetch('https://identity.wenme.net/api/tenant/invite', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer wm_pk_your_api_key_here',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    tenant_id: 'your-organization-uuid',
    email: '[email protected]',
    role: 'member'
  })
});

const result = await response.json();
console.log(result);

{
  "name": "PV Production Integration",
  "tenant_id": "your-organization-uuid",
  "scopes": ["invite:write", "invite:read"],
  "description": "API key for automated user invitations",
  "expires_in_days": 365  // Optional, 0 = never expires
}

{
  "success": true,
  "message": "API key created successfully. Save this key - it won't be shown again!",
  "api_key": {
    "id": "key-uuid",
    "name": "PV Production Integration",
    "key": "wm_pk_ab1234567890abcdef1234567890abcd",  // Only shown once!
    "key_prefix": "wm_pk_ab",
    "scopes": ["invite:write", "invite:read"],
    "expires_at": "2026-12-04T00:00:00Z",
    "created_at": "2025-12-04T00:00:00Z"
  }
}

Content-Type: application/json
Cookie: auth_session=<session_token>
X-CSRF-Token: <csrf_token>

{
  "tenant_id": "uuid-of-organization",
  "email": "[email protected]",
  "role": "member"  // Options: owner, admin, member, viewer, billing
}

{
  "success": true,
  "message": "Invitation sent successfully",
  "invitation": {
    "id": "invitation-uuid",
    "email": "[email protected]",
    "role": "member",
    "status": "pending",
    "expires_at": "2025-12-11T00:00:00Z"
  }
}

{
  "client_id": "your_app_client_id",
  "client_secret": "your_app_client_secret",
  "email": "[email protected]",
  "role": "user",
  "redirect_url": "https://yourapp.com/dashboard"
}

{
  "success": true,
  "invitation_id": "uuid",
  "invitation_link": "https://identity.wenme.net/api/auth/verify-magic-link-redirect?token=...",
  "message": "Invitation sent successfully"
}

curl -X POST https://identity.wenme.net/api/app/invite \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "your_app_client_id",
    "client_secret": "your_app_client_secret",
    "email": "[email protected]",
    "role": "user",
    "redirect_url": "https://yourapp.com/dashboard"
  }'

// When sending the invite, include invitationId in redirect_url
const response = await fetch("https://identity.wenme.net/api/app/invite", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: "your_client_id",
    client_secret: "your_client_secret",
    email: "[email protected]",
    role: "premium",
    redirect_url: `https://yourapp.com/callback?invitationId=${invitationId}`
  })
});

// In your OAuth callback handler
const invitationId = searchParams.get("invitationId");

// Exchange code for tokens, get user info from Wenme...
const userInfo = await wenme.getUserInfo(accessToken);

// Only link if invitationId was explicitly passed
if (invitationId) {
  const invitation = await db.getInvitation(invitationId);
  if (invitation
      && invitation.status === "pending"
      && invitation.email.toLowerCase() === userInfo.email.toLowerCase()) {
    await db.linkUserAndAssignRole(invitationId, userInfo.sub);
  }
  // Mismatch? User still logs in — just no role upgrade
}

curl -X POST https://identity.wenme.net/api/apps \
  -H "Authorization: Bearer wm_pk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corp",
    "redirect_uris": ["https://acme.example.com/auth/callback"],
    "post_logout_redirect_uris": ["https://acme.example.com/"],
    "scopes": ["openid", "profile", "email"],
    "client_type": "confidential",
    "logo_url": "https://acme.example.com/logo.png",
    "metadata": { "partner_tenant_id": "acme-uuid" }
  }'

{
  "id": "9f8b...",
  "client_id": "wm_app_a1b2c3d4e5f6...",
  "client_secret": "<48 hex chars — shown only once>",
  "name": "Acme Corp",
  "redirect_uris": ["https://acme.example.com/auth/callback"],
  "scopes": ["openid", "profile", "email"],
  "client_type": "confidential",
  "metadata": { "partner_tenant_id": "acme-uuid" },
  "created_at": "2026-04-13T10:00:00Z"
}

{
  "id": "<delivery_id>",
  "event": "app.created",
  "timestamp": "2026-04-13T10:00:00Z",
  "data": {
    "app_id": "9f8b...",
    "client_id": "wm_app_...",
    "name": "Acme Corp",
    "client_type": "confidential",
    "scopes": ["openid","profile","email"],
    "metadata": { "partner_tenant_id": "acme-uuid" },
    "created_by": "api_key:<id>",
    "created_at": "2026-04-13T10:00:00Z"
  }
}