Login with Truckaurbus

Your dealer CRM, financing portal or fleet tool can authenticate truckaurbus users instead of running its own login: a button, a consent screen, and you receive a verified identity. It is standard OpenID Connect, so any OAuth library you already use will work. What you get after consent: the user’s stable id, their name, and their verified mobile number. What you never get: their saved vehicles, enquiries, bids, or anything else they do on truckaurbus. The consent screen says exactly this to the user, in plain words.

Registration

Client registration is by arrangement while the program is young: write to developers@truckaurbus.com with your app’s name and redirect URIs. You receive a client_id. Browser and mobile apps are registered as public clients; PKCE is required for everyone, so there is no client secret to leak.

Endpoints

Everything is discoverable from one URL, which is the only one worth hardcoding:

https://id.truckaurbus.com/identity/o/.well-known/openid-configuration

The document lists the authorization, token, userinfo and JWKS endpoints. Point your OIDC library at it and skip the rest of this section.

Scopes and claims

Scope	Consent screen says	Claims granted
`openid`	Sign you in	`sub` (stable user id)
`profile`	Your name	`name`
`phone`	Your verified phone number	`phone_number`, `phone_number_verified`

Request only what you need; the consent screen lists every scope you ask for.

The flow

Authorization code with PKCE, the one every library implements:

Generate a code_verifier and its S256 code_challenge.
Send the user to the authorization endpoint with client_id, redirect_uri, response_type=code, scope, state and the challenge. A signed-in truckaurbus user sees the consent screen immediately; a signed-out one signs in first and returns to it.
The user approves; your redirect_uri receives code and state.
Exchange the code at the token endpoint with your code_verifier. You receive an access_token and an id_token (RS256, verify it against the JWKS from discovery).
Read the claims from the id_token, or call the userinfo endpoint with the access token.

# pip install authlib requests
from authlib.integrations.requests_client import OAuth2Session

DISCOVERY = "https://id.truckaurbus.com/identity/o/.well-known/openid-configuration"
import requests
cfg = requests.get(DISCOVERY).json()

client = OAuth2Session("your_client_id", redirect_uri="https://yourapp.example/callback",
                       scope="openid profile phone", code_challenge_method="S256")
url, state = client.create_authorization_url(cfg["authorization_endpoint"])
# send the user to `url`; on your callback:
token = client.fetch_token(cfg["token_endpoint"], authorization_response=callback_url)
user = requests.get(cfg["userinfo_endpoint"], headers={"Authorization": f"Bearer {token['access_token']}"}).json()
# {"sub": "…", "name": "…", "phone_number": "+91…", "phone_number_verified": true}

The button

Use the wordmark button so people recognise the door. Copy it as is; the wordmark never restyles.

<button style="display:flex;align-items:center;justify-content:center;gap:10px;background:#141414;color:#f5f1e6;border:0;font:600 15px 'IBM Plex Sans',system-ui,sans-serif;padding:13px 20px;cursor:pointer">
  <span style="font:800 17px 'Anek Latin','Arial Narrow',sans-serif;letter-spacing:-0.02em">truck<span style="color:#f2c318">aur</span>bus<span style="color:#f2c318">.</span></span>
  Login with Truckaurbus
</button>

A light variant works too: white background, #141414 text, one-pixel #141414 border, same wordmark.

Rules

PKCE is required; a request without a code challenge is refused.
Redirect URIs are exact-match and https only.
Verify the id_token signature against the discovery JWKS and check aud is your client_id.
The sub claim is the stable key for the user; the phone number can change, sub cannot.
Treat a user’s identity as theirs: if they withdraw consent from their account page, your refresh stops working, and that is the system behaving correctly.

Start

Use the data

Registration

Endpoints

Scopes and claims

The flow

The button

Rules

​Registration

​Endpoints

​Scopes and claims

​The flow

​The button

​Rules

Registration

Endpoints

Scopes and claims

The flow

The button

Rules