> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truckaurbus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Login with Truckaurbus

> Let truckaurbus users sign in to your app with their verified identity. Standard OpenID Connect, PKCE required.

Your dealer CRM, financing portal or fleet tool can authenticate truckaurbus users instead of running its own login: a button, a consent screen, and you receive a verified identity. It is standard OpenID Connect, so any OAuth library you already use will work.

What you get after consent: the user's stable id, their name, and their verified mobile number. What you never get: their saved vehicles, enquiries, bids, or anything else they do on truckaurbus. The consent screen says exactly this to the user, in plain words.

## Registration

Client registration is by arrangement while the program is young: write to [developers@truckaurbus.com](mailto:developers@truckaurbus.com) with your app's name and redirect URIs. You receive a `client_id`. Browser and mobile apps are registered as public clients; PKCE is required for everyone, so there is no client secret to leak.

## Endpoints

Everything is discoverable from one URL, which is the only one worth hardcoding:

```
https://id.truckaurbus.com/identity/o/.well-known/openid-configuration
```

The document lists the authorization, token, userinfo and JWKS endpoints. Point your OIDC library at it and skip the rest of this section.

## Scopes and claims

| Scope     | Consent screen says        | Claims granted                          |
| --------- | -------------------------- | --------------------------------------- |
| `openid`  | Sign you in                | `sub` (stable user id)                  |
| `profile` | Your name                  | `name`                                  |
| `phone`   | Your verified phone number | `phone_number`, `phone_number_verified` |

Request only what you need; the consent screen lists every scope you ask for.

## The flow

Authorization code with PKCE, the one every library implements:

1. Generate a `code_verifier` and its S256 `code_challenge`.
2. Send the user to the authorization endpoint with `client_id`, `redirect_uri`, `response_type=code`, `scope`, `state` and the challenge. A signed-in truckaurbus user sees the consent screen immediately; a signed-out one signs in first and returns to it.
3. The user approves; your `redirect_uri` receives `code` and `state`.
4. Exchange the code at the token endpoint with your `code_verifier`. You receive an `access_token` and an `id_token` (RS256, verify it against the JWKS from discovery).
5. Read the claims from the `id_token`, or call the userinfo endpoint with the access token.

```python theme={"system"}
# pip install authlib requests
from authlib.integrations.requests_client import OAuth2Session

DISCOVERY = "https://id.truckaurbus.com/identity/o/.well-known/openid-configuration"
import requests
cfg = requests.get(DISCOVERY).json()

client = OAuth2Session("your_client_id", redirect_uri="https://yourapp.example/callback",
                       scope="openid profile phone", code_challenge_method="S256")
url, state = client.create_authorization_url(cfg["authorization_endpoint"])
# send the user to `url`; on your callback:
token = client.fetch_token(cfg["token_endpoint"], authorization_response=callback_url)
user = requests.get(cfg["userinfo_endpoint"], headers={"Authorization": f"Bearer {token['access_token']}"}).json()
# {"sub": "…", "name": "…", "phone_number": "+91…", "phone_number_verified": true}
```

## The button

Use the wordmark button so people recognise the door. Copy it as is; the wordmark never restyles.

```html theme={"system"}
<button style="display:flex;align-items:center;justify-content:center;gap:10px;background:#141414;color:#f5f1e6;border:0;font:600 15px 'IBM Plex Sans',system-ui,sans-serif;padding:13px 20px;cursor:pointer">
  <span style="font:800 17px 'Anek Latin','Arial Narrow',sans-serif;letter-spacing:-0.02em">truck<span style="color:#f2c318">aur</span>bus<span style="color:#f2c318">.</span></span>
  Login with Truckaurbus
</button>
```

A light variant works too: white background, `#141414` text, one-pixel `#141414` border, same wordmark.

## Rules

* PKCE is required; a request without a code challenge is refused.
* Redirect URIs are exact-match and `https` only.
* Verify the `id_token` signature against the discovery JWKS and check `aud` is your `client_id`.
* The `sub` claim is the stable key for the user; the phone number can change, `sub` cannot.
* Treat a user's identity as theirs: if they withdraw consent from their account page, your refresh stops working, and that is the system behaving correctly.