Sign in with DeHub — OAuth and Mini App Tokens

There are two ways to know who a DeHub user is. Inside a mini app, ask the SDK for a signed token. On any other website or app, use standard OAuth. Either way the user's id is their DeHub wallet address, the same id used everywhere on DeHub.

Inside a mini app

// In your mini app
const { token } = await dehub.auth.getToken();
await fetch('/api/session', { method: 'POST', headers: { Authorization: `Bearer ${token}` } });

// On your server (Node, any JOSE library works)
import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(
  new URL('https://aigxuutjaqsywioxjefr.supabase.co/functions/v1/miniapp-auth'),
);

const { payload } = await jwtVerify(token, JWKS, {
  issuer: 'https://riftn.com',
  audience: 'tipjar.example.com', // your domain
});
const wallet = payload.sub; // the user's DeHub wallet, lowercase

The token is an ES256 JWT that lasts one hour. DeHub addresses it to the domain it actually loaded, so a token made for one app can never be used on another. The SDK caches it and fetches a fresh one when it is close to expiring.

On any website or app (OAuth)

DeHub speaks the Mastodon OAuth API, so any OAuth 2.0 library works, and so does every Mastodon client library. PKCE is supported and recommended.

1. Register your app once.

curl -X POST https://riftn.com/api/v1/apps \
  -H 'Content-Type: application/json' \
  -d '{"client_name":"Tip Jar","redirect_uris":"https://tipjar.example.com/callback","scopes":"profile","website":"https://tipjar.example.com"}'

Keep the client_id and client_secret it returns. They are shown once.

2. Send the user to DeHub to approve.

https://riftn.com/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://tipjar.example.com/callback
  &scope=profile
  &state=RANDOM_STATE
  &code_challenge=PKCE_CHALLENGE
  &code_challenge_method=S256

3. Swap the code for a token on your server.

curl -X POST https://riftn.com/oauth/token \
  -d grant_type=authorization_code \
  -d code=CODE_FROM_REDIRECT \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d redirect_uri=https://tipjar.example.com/callback \
  -d code_verifier=PKCE_VERIFIER

4. Read who signed in.

curl https://riftn.com/api/v1/accounts/verify_credentials \
  -H 'Authorization: Bearer ACCESS_TOKEN'

The answer's id is the user's wallet address. acct is their handle, plus display_name, avatar and url.

Scopes

Ask only for what you need. People see the list on the approval screen and can revoke any app in their DeHub settings.

AI agents

AI assistants sign in through the DeHub MCP server at https://riftn.com/mcp, which runs its own OAuth flow with dynamic client registration. See Connect.