1. Register the application
Sign in to the Developer Portal, create an application, register its exact redirect URI, and note its client ID. A browser client must not carry a client secret. A server-backed client may use a secret only if its registration requires one; keep it on the server.
2. Begin the login transaction
Generate a new high-entropy PKCE verifier and random state for every attempt. Persist both in a short-lived transaction tied to the browser. Derive the S256 challenge, then send the browser to /oauth/authorize.
GET https://auth.bhauu.online/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fcallback&response_type=code&scope=profile%20email&state=RANDOM_TRANSACTION_STATE&code_challenge=BASE64URL_SHA256_VERIFIER&code_challenge_method=S2563. Handle the callback
The user authenticates and grants requested access on Bhauu Auth. At your registered callback, reject missing or mismatched state and handle authorization errors. Exchange the one-time code promptly with the same redirect URI and original verifier. Codes are short-lived, approximately 90 seconds.
POST https://auth.bhauu.online/oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code&client_id=YOUR_CLIENT_ID&code=CALLBACK_CODE&redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fcallback&code_verifier=ORIGINAL_TRANSACTION_VERIFIER4. Establish your own session
Use the returned Bearer access token with UserInfo where appropriate. If your application has a backend, create an application-owned session after validating the exchange; protect its cookie and CSRF boundary. A Bhauu authentication session, OAuth authorization, and your application's session are different things.
5. Plan for revocation
Handle Bhauu-side revocation and your own logout separately. A local application session will not disappear merely because an OAuth grant was revoked; your application must revalidate or expire it. See sessions and revocation.