The identity platform for every app.

// 1. Send users to Towly to sign in
const authorizeUrl = "https://api.towly.ai/oauth2/auth"
  + "?client_id=YOUR_CLIENT_ID"
  + "&redirect_uri=https://yourapp.com/callback"
  + "&response_type=code&scope=openid+profile+email";
window.location = authorizeUrl;

// 2. Exchange the code for tokens (server side, never in the browser)
const tokens = await fetch("https://api.towly.ai/oauth2/token", {
  method: "POST",
  body: new URLSearchParams({
    grant_type: "authorization_code",
    code, redirect_uri: "https://yourapp.com/callback",
    client_id: "YOUR_CLIENT_ID", client_secret: "YOUR_SECRET",
  }),
}).then(r => r.json());

// 3. Verify the session on every request
const session = await fetch("https://auth.towly.ai/sessions/whoami", {
  headers: { Authorization: `Bearer ${tokens.access_token}` },
}).then(r => r.json());

import requests

AUTH = "https://api.towly.ai/oauth2"

# 1. Send users to Towly to sign in (open in the browser):
#    {AUTH}/auth?client_id=YOUR_CLIENT_ID&redirect_uri=...
#    &response_type=code&scope=openid profile email

# 2. Exchange the code for tokens (server side, never in the browser)
tokens = requests.post(f"{AUTH}/token", data={
    "grant_type": "authorization_code",
    "code": code,
    "redirect_uri": "https://yourapp.com/callback",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_SECRET",
}).json()

# 3. Verify the session on every request
session = requests.get(
    "https://auth.towly.ai/sessions/whoami",
    headers={"Authorization": f"Bearer {tokens['access_token']}"},
).json()