Sign in with FleetBold

FleetBold is an OpenID Connect provider: add openid to the OAuth flow you already use and the token response carries a signed id_token saying who the user is. Available once FleetBold enables OpenID Connect; until then openid is refused with invalid_scope (openid_unavailable).

curl https://partners-api.fleetbold.com/.well-known/openid-configuration

• scope must contain openid; profile and email are accepted as aliases of profile:read and profile:email (also on refresh).
• Send a nonce (at most 512 characters) and check it in the id_token.
• FleetBold asks for the FleetBold e-mail and password on every authorization, and the id_token auth_time is that sign-in. With max_age (minimum 60 s), or with prompt=login (5 minutes), a user who takes longer than that between signing in and approving is asked to sign in again. prompt=consent changes nothing: consent is shown every time.
• prompt=none never shows a page and never returns a code: a live app gets login_required at once; an app that is not live yet gets a FleetBold page whose Return link delivers the same login_required. Keep users connected with offline_access and refresh tokens instead.
• Validate the id_token: signature with the key of its kid from jwks_uri (refetch the JWKS on an unknown kid), iss, aud/azp = your client_id, exp, nonce.
• sub (usr_…) is the stable account key — never the e-mail. The id_token is issued only on the code exchange, never on refresh.