Lexicon Garden

ai.newnal.illi.account.parent.startOAuth

Start a parent's OAuth sign-in on the device through the PDN's own page (BFF), for an existing Newnal ID whose credentials are typed on the PDN page. Device-created accounts, and existing ones whose credentials the device app takes itself, sign in with account.parent.signIn instead. client=native ends with a one-time code on the device app's App Link for account.exchangeCode instead of a cookie.

Repository @illi-service.newnal.id did:plc:uztm7bi2ce42dez3uu3qafro namespace authority
Details · procedure
Kindprocedure
Authorityparent.account.illi.newnal.ai
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

client

string

web (default): the callback sets the device-app cookie. native: the callback redirects to the device app's App Link with a 60-second one-time code for account.exchangeCode.

  • default: "web"
  • knownValues: web | native

codeChallenge

string

Required with client native: base64url(SHA-256(codeVerifier)) without padding. The one-time code the callback returns can only be exchanged with that verifier (account.exchangeCode).

  • minLength: 43
  • maxLength: 43

deviceId

string
  • maxLength: 64

mode

requiredstring
  • knownValues: create | signIn

slot

integer
  • minimum: 1
  • maximum: 2

Output

application/json

loginUrl

requiredstring · uri

Errors

ParentLimitReached

No description in schema.

ParentAlreadyLinked

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • ai.newnal.illi.account.parent.signIn

    procedure

    Sign a parent account in to ILLI from the device without the PDN's OAuth sign-in and consent screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session, joins the account to the service sphere on first use and returns the device-app session. Used at first connection and at every re-login.

  • ai.newnal.illi.account.exchangeCode

    procedure

    Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.

  • ai.newnal.illi.account.family.signIn

    procedure

    Sign a family member in to ILLI from the native family app without the PDN's OAuth sign-in and consent screen: the app presents the member's scoped familyApp app password (which it keeps) and its platform attestation; the Service Agent Node opens the session, joins the account to the service sphere on first use and returns the family session. Used at first connection and at every re-login. Web clients use the OAuth BFF (/oauth/login) instead.