Integrate Rocket ID

Open Rocket ID with the developer account managing the app. Access and eligibility are checked by the portal. Register the app and its exact callback URL; use separate test and production registrations where the portal requires them.

Only deliberately integrated apps support Continue with Rocket. A directory listing, public profile or membership does not connect an app automatically. The hosted official button kit controls presentation; you still implement the authorization flow.

Use authorization code with S256 PKCE. Send response_type=code, the registered client_id and redirect_uri, scope, a random state, code_challenge and code_challenge_method=S256. The openid scope is required; profile and email are optional. Use nonce when validating an OIDC ID token.

Redirect the user to the authorization endpoint, let them authenticate and review consent, then validate state on your callback. Exchange the one-time code with the same redirect URI and the original code_verifier. Do not put a Rocket session token into your app or trust an unvalidated callback parameter.

The supported client flow is public PKCE. Do not assume confidential-client authentication or refresh tokens are supported.

Authorization endpoint: https://tryrocket.ai/connect/authorize

Discovery document: https://lcujmvdgczkjxdstzhnr.supabase.co/functions/v1/rocket-connect-discovery

Use the discovery document for the token, UserInfo and JWKS endpoints. At the token endpoint, POST grant_type=authorization_code, client_id, code, redirect_uri and code_verifier with Content-Type application/x-www-form-urlencoded. Read UserInfo with the Rocket integration access token; validate ID-token signatures, issuer, audience, expiry and nonce against the published metadata and keys.

Create your own application's session after validation. Test denied consent, wrong state, invalid PKCE, reused codes and revoked authorization. Users can revoke connected applications in Rocket Settings; your integration must handle authorization failures rather than continuing to trust an old token.