OrangeCheck Connect

Add OrangeCheck to your existing login. Keep Auth0, Clerk, NextAuth, Google, email/password — whatever you already run. It works exactly as it does today. Drop in one server-side call so that when your user signs in, an OrangeCheck identity (did:oc) is created for them at the same time.

There is no new SDK. A Connect integration is one HTTPS POST.

New to OrangeCheck integration? See the Integration overview first — Connect is one of two pathways. If you'd rather OrangeCheck be your sign-in (no login of your own), that's @orangecheck/auth-client.

How it works

Register a Connect app at me.ochk.io/me/developer/connect — you get an API key.
Your user signs in however they already do. Nothing changes.
Right after, your backend calls POST https://ochk.io/api/connect/provision with your API key and your own id for that user.
OrangeCheck returns a did:oc. Store it on your user record.

The whole integration

// Anywhere after your own login succeeds — Auth0, Clerk, Google, your own SSO,
// it does not matter. Run this from your backend.
const res = await fetch('https://ochk.io/api/connect/provision', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        Authorization: `Bearer ${process.env.OCHK_CONNECT_KEY}`,
    },
    body: JSON.stringify({ user_id: yourUser.id }),
});
const { did_oc, is_new } = await res.json();
// store did_oc on your user record — that is the whole integration.

OCHK_CONNECT_KEY is the API key from the console. user_id is your own stable id for the user. That is everything — no token to forward, no provider to name, no keypair, no redirect.

The call is idempotent: run it on every login if you like — the same user always resolves to the same did:oc (is_new tells you whether this call created it).

What you get back

{ "ok": true, "did_oc": "did:oc:…", "is_new": true }

The provisioned account is OrangeCheck-issued: the user holds no signing key of their own on this path, so OrangeCheck holds the identity and anything that accrues to it. Federation custody, and the user's graduation to self-custody, is where that goes — it is the design and it is not live. The machine-readable state is /api/federations; the long form is federation custody. You now know "my user ↔ this OrangeCheck identity" and can show it, or call other OrangeCheck APIs on their behalf.

Notes

Server-to-server only. Call /api/connect/provision from your backend — never the browser. The API key must stay secret.
The key is shown once. Save it when you register the app. Lost it? Hit regenerate key in the console — the old key stops working immediately.
Optional email. You may also pass the user's email ({ user_id, email }). It is recorded as a hint so the same person can be unified to one identity across integrators later. The base call does not need it, and it is never treated as a verified identity.
An integrator can only ever create and manage its own users' OrangeCheck accounts — a Connect key can never reach into anyone else's identity.