ai.newnal.illi.account.parent.startOAuth

illi-service.newnal.id

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Start a parent's OAuth sign-in on the device through the PDN's own page (BFF), for an existing Newnal ID whose credentials are typed on the PDN page. Device-created accounts, and existing ones whose credentials the device app takes itself, sign in with account.parent.signIn instead. client=native ends with a one-time code on the device app's App Link for account.exchangeCode instead of a cookie.",
      "errors": [
        {
          "name": "ParentLimitReached"
        },
        {
          "name": "ParentAlreadyLinked"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "client": {
              "default": "web",
              "description": "web (default): the callback sets the device-app cookie. native: the callback redirects to the device app's App Link with a 60-second one-time code for account.exchangeCode.",
              "knownValues": [
                "web",
                "native"
              ],
              "type": "string"
            },
            "codeChallenge": {
              "description": "Required with client native: base64url(SHA-256(codeVerifier)) without padding. The one-time code the callback returns can only be exchanged with that verifier (account.exchangeCode).",
              "maxLength": 43,
              "minLength": 43,
              "type": "string"
            },
            "deviceId": {
              "maxLength": 64,
              "type": "string"
            },
            "mode": {
              "knownValues": [
                "create",
                "signIn"
              ],
              "type": "string"
            },
            "slot": {
              "maximum": 2,
              "minimum": 1,
              "type": "integer"
            }
          },
          "required": [
            "mode"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "loginUrl": {
              "format": "uri",
              "type": "string"
            }
          },
          "required": [
            "loginUrl"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "ai.newnal.illi.account.parent.startOAuth",
  "lexicon": 1
}

Validate Record

Validate a record against ai.newnal.illi.account.parent.startOAuth

Validation Options
Treat any remaining unresolved references as valid

Metadata

DID
did:plc:uztm7bi2ce42dez3uu3qafro
CID
bafyreias6zf5opxvrsh5nyqkkakekfsgcv6haqle37s44tniuagi2xazry
Indexed At
2026-10-23 07:24 UTC
AT-URI
at://did:plc:uztm7bi2ce42dez3uu3qafro/com.atproto.lexicon.schema/ai.newnal.illi.account.parent.startOAuth

Version History (3 versions)

Similar Lexicons

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • Sign a parent account in to ILLI from the device without a screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session,…

  • Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events…

  • Sign a family member in to ILLI from the native family app without a screen: the app presents the member's scoped familyApp app password (which it keeps) and its platform attestation; the Service Agent Node opens the se…

Lexicon Garden

@