Briij Developers

Path 1 · Core offering

Identity + Wallet (WaaS)

You are a developer who needs Login with Briij and a white-labelable wallet for end users — without standing up your own IdP, WebAuthn RP, or MPC stack.

← All paths · Need chat/community too? After this path, open Communities add-on.

The story

Your user taps Continue with Briij in your app. Briij runs passkey + wallet UX (brandable). You receive a normal OIDC authorization code, exchange it for tokens, and get a stable sub. Optionally drive wallet actions with the WaaS browser SDK under your product chrome.

Commercial model: one Partner, free/pro/growth caps on auth MAU/RPM. WaaS is part of this core path — not a second bill. You monetize your users; Briij meters platform capacity.

Walkthrough

  1. Create a client

    Open the developer portal, sign in with your Briij passkey, and register an app.

    • Public client for SPA / mobile / desktop — PKCE required, no secret.
    • Confidential client for a backend that can hold a secret.

    Copy client_id (and secret if confidential). Add exact redirect URI(s).

    Portal apps start on free tier (1 client, 100 MAU / 30d, 30 RPM). Details: limits.

  2. Point your OIDC library at Briij

    Issuer / authority:  https://auth.briij.org/
Discovery:           https://auth.briij.org/.well-known/openid-configuration
Scopes (start here): openid profile offline_access
Optional API scope:  briij.waas

    Use any standard OIDC stack (AppAuth, oidc-client-ts, IdentityModel, etc.). See SDKs.

  3. Send users through wallet login

    Start authorization code + PKCE. Add wallet=1 so Briij hosts the passkey/wallet picker for you:

    GET https://auth.briij.org/connect/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://your.app/auth/callback
  &response_type=code
  &scope=openid%20profile%20offline_access
  &state=RANDOM
  &code_challenge=BASE64URL_SHA256(verifier)
  &code_challenge_method=S256
  &wallet=1

    Prefer discovery document values over hardcoding paths long-term.

  4. Exchange the code

    POST https://auth.briij.org/connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=...
&redirect_uri=https://your.app/auth/callback
&client_id=YOUR_CLIENT_ID
&code_verifier=VERIFIER

    Confidential clients also send client_secret. Full credential matrix: credentials.

  5. Read the user · optional UserInfo

    GET https://auth.briij.org/oauth2/userinfo
Authorization: Bearer ACCESS_TOKEN

    Stable account key = JWT sub. Store that as your user id mapping.

  6. White-label the wallet (WaaS)

    Now: users complete passkey/wallet inside Briij-hosted picker (wallet=1). Your app keeps its own chrome before/after redirect.

    Browser SDK (when you need in-app wallet actions):

    https://wallet.briij.org/sdk/mpc-waas-client.js
Wallet PWA: https://wallet.briij.org
API:        https://api.briij.org

    Coming next for partners: brand pack (name, logo, colors) on the hosted picker; custom login domain on higher tiers. Same issuer and tokens.

    Do not re-implement WebAuthn attestation in your app for Login-with-Briij. Stay on the hosted wallet=1 path unless you are building a custom enterprise embed with Briij support.

  7. Ship · watch limits

    Free tier returns 429 when RPM is exceeded and 402 when commercial caps (e.g. MAU) are hit. Honor Retry-After; show upgrade UX on 402. See limits & errors.

Done when

Create client Add Communities next Credentials reference