Integrate a public client with generative AI Developer

Last updated Aug 15, 2026

Integrate a public client with generative AI

This page is for developers who want generative AI to integrate Swaymoon Account as a public client (clientType=public, token endpoint auth none): pure HTML, static sites, or browser-only apps. Runnable scripts: Minimal Python example.

If the project has a server, API Route, Serverless Function, or BFF that can keep secrets, use a confidential client instead. Read Integrate a confidential client with generative AI.

When to use which

Better as a public client	Better as a confidential client
Pure HTML / static site / pure SPA (token exchange in the browser)	Web apps with a backend session and secret management
Lightweight local or demo clients	Products that need Refresh Token and long-lived sessions
Desktop / mobile clients that cannot embed a secret safely	Calling protected APIs on the user’s behalf from a server

Product rules (same as the portal):

No client_secret is issued. Do not use HTTP Basic when exchanging tokens.
PKCE (S256) required.
No refresh_token. Access Token about 5 minutes. After expiry, run the authorization-code flow again.
Redirect URIs must be registered in advance and match redirect_uri in the authorization request character for character. Encode the authorize URL once (for example URLSearchParams / urllib.parse.urlencode). Do not encode an already-encoded URI again.

Create in the portal

Sign in at develop.swaymoon.com, open Identifiers, click +.
Description: a name users will recognize on the consent page. Client type: Public client (cannot be changed to confidential later).
Icon: default or upload and crop.
Redirect URI: register the callback. The Python public demo uses http://127.0.0.1:8765/callback.
Capabilities: keep required openid. Set email and profile fields as needed (optional or required; required needs a reason and privacy policy). See Scopes and consent.
After Confirm, click Register and copy client_id (no client_secret).

http://127.0.0.1 and http://localhost are different addresses. Protocol parameters: Authorization code and PKCE.

Give the prompt to the AI

When integrating an existing frontend / static project, you can paste the following prompt (do not send real tokens or a full callback query string):

Integrate “Sign in with Swaymoon Account” in the current frontend-only / static project (public client).
- clientType=public, token endpoint auth none. No client_secret and no HTTP Basic.
- Issuer: https://api-passport.swaymoon.com ; Discovery is authoritative.
- Authorization Code + PKCE (S256). Token form includes grant_type, code, redirect_uri, client_id, code_verifier.
- No refresh_token. Default scope includes openid. Add email or profile fields only if needed. Do not use a bundled profile.
- Put state / code_verifier in sessionStorage. Identify the user with sub. Output the Redirect URI that must be registered.

Local stdlib walkthrough: Minimal Python example. Prompt for a server: Integrate a confidential client with generative AI.

Security notes

Sign-in and authorization must go to the official Swaymoon Account domain.
client_id may appear in the frontend. Do not invent a client_secret.
Minimum scope. Honor the user unchecking optional scopes. Ungranted UserInfo profile fields are default placeholders (see Tokens and user info).
If you need “stay signed in”, add a server that can keep secrets and switch to a confidential client plus your own session.

Troubleshooting: Examples and troubleshooting.