KRID Platform APIs

// server.js — "Sign in with KRID" in ~45 lines (OAuth 2.0 + PKCE).
// Change the three values marked TODO. Node 18+ (built-in fetch).
import express from 'express';
import crypto from 'crypto';

const app = express();
const KSAUTH        = 'https://api.ikatsina.ng/api/ksauth';
const CLIENT_ID     = process.env.KRID_CLIENT_ID;      // TODO ksauth_...
const CLIENT_SECRET = process.env.KRID_CLIENT_SECRET;  // TODO
const REDIRECT_URI  = 'https://your-app.gov.ng/auth/krid/callback'; // TODO (must be registered)

const b64url = (buf) => buf.toString('base64url');
const pending = new Map(); // state -> code_verifier (use a session/cookie in prod)

// 1) Start login: build PKCE, then bounce the resident to KRID.
app.get('/auth/krid/login', (req, res) => {
  const state     = b64url(crypto.randomBytes(16));
  const verifier  = b64url(crypto.randomBytes(32));
  const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
  pending.set(state, verifier);

  const url = new URL(`${KSAUTH}/oauth/authorize`);
  url.search = new URLSearchParams({
    response_type: 'code',
    client_id: CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    scope: 'openid profile email phone',
    state,
    code_challenge: challenge,
    code_challenge_method: 'S256',
  }).toString();
  res.redirect(url.toString());
});

// 2) Callback: verify state, swap the code for tokens, read the claims.
app.get('/auth/krid/callback', async (req, res) => {
  const { code, state } = req.query;
  const verifier = pending.get(state);
  if (!verifier) return res.status(400).send('Invalid state');
  pending.delete(state);

  const tokenRes = await fetch(`${KSAUTH}/oauth/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      grant_type: 'authorization_code',
      code, redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID, client_secret: CLIENT_SECRET,
      code_verifier: verifier,
    }),
  });
  const tokens = await tokenRes.json();  // { access_token, id_token, refresh_token, ... }

  const infoRes = await fetch(`${KSAUTH}/oauth/userinfo`, {
    headers: { Authorization: `Bearer ${tokens.access_token}` },
  });
  const resident = await infoRes.json();
  // { sub, resident_id, krid_number, full_name, email, phone, lga, ward, roles }

  // TODO: start your own session for the resident, then redirect into your app.
  res.json(resident);
});

app.listen(3000, () => console.log('http://localhost:3000/auth/krid/login'));

https://api.ikatsina.ng/api/ksauth/oauth/authorize
  ?response_type=code
  &client_id=ksauth_your_client_id
  &redirect_uri=https://your-app.gov.ng/callback
  &scope=openid%20profile%20email%20phone
  &state=RANDOM_STATE
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256

curl -X POST https://api.ikatsina.ng/api/ksauth/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTH_CODE_FROM_REDIRECT",
    "redirect_uri": "https://your-app.gov.ng/callback",
    "client_id": "ksauth_your_client_id",
    "client_secret": "your_client_secret",
    "code_verifier": "ORIGINAL_PKCE_VERIFIER"
  }'