Kiges ID API

POST https://id.kiges.cc/api/oauth/token

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&redirect_uri=https://yourapp.com/callback
&code=AUTHORIZATION_CODE
&code_verifier=PKCE_CODE_VERIFIER

{
    "token_type": "Bearer",
    "expires_in": 31536000,
    "access_token": "eyJ0eXAiOiJKV1Q...",
    "refresh_token": "def502003b4e..."
}

Authorization: Bearer eyJ0eXAiOiJKV1Q...

https://id.kiges.cc/oauth/authorize?
    client_id=YOUR_CLIENT_ID
    &redirect_uri=https://yourapp.com/callback
    &response_type=code
    &scope=openid profile email organizations org:read
    &state=random_csrf_token
    &code_challenge=PKCE_CHALLENGE
    &code_challenge_method=S256

{
    "error": "insufficient_scope",
    "message": "The access token does not have the 'org:read' scope."
}

// Validation Error (422)
{
    "message": "The given data was invalid.",
    "errors": {
        "name": ["The name field is required."]
    }
}

// Generate PKCE challenge
async function generatePKCE() {
    const verifier = crypto.randomUUID() + crypto.randomUUID();
    const encoder = new TextEncoder();
    const data = encoder.encode(verifier);
    const hash = await crypto.subtle.digest('SHA-256', data);
    const challenge = btoa(String.fromCharCode(...new Uint8Array(hash)))
        .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
    return { verifier, challenge };
}

const { verifier, challenge } = await generatePKCE();
sessionStorage.setItem('pkce_verifier', verifier);

const authUrl = new URL('https://id.kiges.cc/oauth/authorize');
authUrl.searchParams.set('client_id', 'YOUR_CLIENT_ID');
authUrl.searchParams.set('redirect_uri', 'https://yourapp.com/callback');
authUrl.searchParams.set('response_type', 'code');
authUrl.searchParams.set('scope', 'openid profile email organizations org:read');
authUrl.searchParams.set('state', crypto.randomUUID());
authUrl.searchParams.set('code_challenge', challenge);
authUrl.searchParams.set('code_challenge_method', 'S256');

window.location.href = authUrl.toString();

// routes/web.php callback handler
Route::get('/callback', function (Request $request) {
    // Exchange authorization code for access token
    $response = Http::asForm()->post('https://id.kiges.cc/api/oauth/token', [
        'grant_type'    => 'authorization_code',
        'client_id'     => config('services.kiges.client_id'),
        'client_secret' => config('services.kiges.client_secret'),
        'redirect_uri'  => config('services.kiges.redirect'),
        'code'          => $request->code,
    ]);

    if (!$response->ok()) {
        return redirect('/login')->withErrors('Authentication failed');
    }

    $tokens = $response->json();
    $accessToken = $tokens['access_token'];

    // Fetch user profile + organizations in one call
    $userData = Http::withToken($accessToken)
        ->get('https://id.kiges.cc/api/v1/me')
        ->json('data');

    // Create or update user in your database
    $user = User::updateOrCreate(
        ['kiges_uuid' => $userData['uuid']],
        [
            'name'         => $userData['name'],
            'surname'      => $userData['surname'],
            'email'        => $userData['email'],
            'kiges_token'  => $accessToken,
            'kiges_refresh' => $tokens['refresh_token'],
        ]
    );

    // Sync organizations
    foreach ($userData['organizations'] ?? [] as $orgData) {
        $org = Organization::updateOrCreate(
            ['kiges_uuid' => $orgData['uuid']],
            [
                'name' => $orgData['name'],
                'slug' => $orgData['slug'],
            ]
        );
        $org->members()->updateOrCreate(
            ['user_id' => $user->id],
            ['role' => $orgData['role'], 'permissions' => $orgData['permissions']]
        );
    }

    Auth::login($user);
    return redirect('/dashboard');
});

// Express callback route
app.get('/callback', async (req, res) => {
    const { code, state } = req.query;

    // Exchange code for token
    const tokenRes = await fetch('https://id.kiges.cc/api/oauth/token', {
        method: 'POST',
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
        body: new URLSearchParams({
            grant_type: 'authorization_code',
            client_id: process.env.KIGES_CLIENT_ID,
            client_secret: process.env.KIGES_CLIENT_SECRET,
            redirect_uri: process.env.KIGES_REDIRECT_URI,
            code,
        }),
    });

    const tokens = await tokenRes.json();

    // Fetch user profile + organizations
    const meRes = await fetch('https://id.kiges.cc/api/v1/me', {
        headers: { Authorization: `Bearer ${tokens.access_token}` },
    });
    const { data: userData } = await meRes.json();

    // Create session with user data + organizations
    req.session.user = {
        uuid: userData.uuid,
        name: userData.name,
        email: userData.email,
        organizations: userData.organizations,
        accessToken: tokens.access_token,
    };

    res.redirect('/dashboard');
});

function OrganizationSwitcher({ organizations, currentOrg, onSwitch }) {
    return (
        <select
            value={currentOrg?.uuid || ''}
            onChange={(e) => onSwitch(e.target.value)}
        >
            {organizations.map(org => (
                <option key={org.uuid} value={org.uuid}>
                    {org.name} ({org.role})
                </option>
            ))}
        </select>
    );
}

// When organization changes, re-fetch data scoped to that org
async function switchOrganization(orgUuid) {
    // Store selected org in session/state
    setCurrentOrg(orgUuid);

    // Fetch org details + members from Kiges ID API
    const orgRes = await fetch(`/api/kiges/organizations/${orgUuid}`);
    const { data } = await orgRes.json();

    // Check the user's permissions to show/hide UI elements
    const canManage = data.your_permissions.includes('manage_members');
    setCanManageMembers(canManage);
}

// In your SaaS backend, proxy requests to Kiges ID API
Route::middleware('auth')->prefix('api/kiges')->group(function () {

    Route::get('/organizations', function (Request $request) {
        return Http::withToken($request->user()->kiges_token)
            ->get('https://id.kiges.cc/api/v1/organizations')
            ->json();
    });

    Route::get('/organizations/{uuid}', function (Request $request, $uuid) {
        return Http::withToken($request->user()->kiges_token)
            ->get("https://id.kiges.cc/api/v1/organizations/{$uuid}")
            ->json();
    });

    Route::get('/organizations/{uuid}/members', function (Request $request, $uuid) {
        return Http::withToken($request->user()->kiges_token)
            ->get("https://id.kiges.cc/api/v1/organizations/{$uuid}/members")
            ->json();
    });

    Route::get('/organizations/{uuid}/permissions', function (Request $request, $uuid) {
        $perms = $request->query('permissions', '');
        return Http::withToken($request->user()->kiges_token)
            ->get("https://id.kiges.cc/api/v1/organizations/{$uuid}/permissions", [
                'permissions' => $perms,
            ])
            ->json();
    });
});

// In your SaaS webhook endpoint
Route::post('/webhooks/kiges', function (Request $request) {
    $secret = config('services.kiges.webhook_secret');
    $timestamp = $request->header('X-Kiges-Timestamp');
    $signature = $request->header('X-Kiges-Signature-256');
    $body = $request->getContent();

    // Verify signature
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $body, $secret);

    if (!hash_equals($expected, $signature)) {
        return response('Invalid signature', 403);
    }

    // Optional: reject old timestamps (prevent replay attacks)
    if (abs(time() - (int) $timestamp) > 300) {
        return response('Timestamp too old', 403);
    }

    $event = $request->header('X-Kiges-Event');
    $deliveryId = $request->header('X-Kiges-Delivery');
    $payload = $request->json();

    // Process the event
    match ($event) {
        'member.added'   => $this->handleMemberAdded($payload),
        'member.removed' => $this->handleMemberRemoved($payload),
        'member.updated' => $this->handleMemberUpdated($payload),
        'organization.updated' => $this->handleOrgUpdated($payload),
        'role.updated'   => $this->handleRoleUpdated($payload),
        default          => null, // Ignore unknown events
    };

    return response('OK', 200);
});

const crypto = require('crypto');

app.post('/webhooks/kiges', express.raw({ type: 'application/json' }), (req, res) => {
    const secret = process.env.KIGES_WEBHOOK_SECRET;
    const timestamp = req.headers['x-kiges-timestamp'];
    const signature = req.headers['x-kiges-signature-256'];
    const body = req.body.toString();

    const expected = 'sha256=' + crypto
        .createHmac('sha256', secret)
        .update(timestamp + '.' + body)
        .digest('hex');

    if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
        return res.status(403).send('Invalid signature');
    }

    const event = req.headers['x-kiges-event'];
    const payload = JSON.parse(body);

    switch (event) {
        case 'member.added':
            handleMemberAdded(payload);
            break;
        case 'member.removed':
            handleMemberRemoved(payload);
            break;
        case 'organization.updated':
            handleOrgUpdated(payload);
            break;
        // ... handle other events
    }

    res.status(200).send('OK');
});

import hmac
import hashlib
import time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = 'your_webhook_secret'

@app.route('/webhooks/kiges', methods=['POST'])
def handle_webhook():
    timestamp = request.headers.get('X-Kiges-Timestamp', '')
    signature = request.headers.get('X-Kiges-Signature-256', '')
    body = request.get_data(as_text=True)

    expected = 'sha256=' + hmac.new(
        WEBHOOK_SECRET.encode(),
        f'{timestamp}.{body}'.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        abort(403, 'Invalid signature')

    if abs(time.time() - int(timestamp)) > 300:
        abort(403, 'Timestamp too old')

    event = request.headers.get('X-Kiges-Event')
    payload = request.get_json()

    if event == 'member.added':
        handle_member_added(payload)
    elif event == 'member.removed':
        handle_member_removed(payload)
    elif event == 'organization.updated':
        handle_org_updated(payload)

    return 'OK', 200

{
    "event": "member.added",
    "timestamp": "2026-03-19T14:30:00+00:00",
    "organization": {
        "uuid": "550e8400-e29b-41d4-a716-446655440000",
        "name": "Acme Corp",
        "slug": "acme-corp"
    },
    "member": {
        "user_uuid": "user-uuid-123",
        "email": "john@example.com",
        "name": "John",
        "surname": "Doe",
        "role": "member",
        "permissions": ["view_members", "invite_members"]
    },
    "data": {
        "role": "member",
        "source": "invitation"
    }
}

{
    "event": "member.updated",
    "timestamp": "2026-03-19T14:35:00+00:00",
    "organization": {
        "uuid": "550e8400-...",
        "name": "Acme Corp",
        "slug": "acme-corp"
    },
    "member": {
        "user_uuid": "user-uuid-123",
        "email": "john@example.com",
        "name": "John",
        "surname": "Doe",
        "role": "admin",
        "permissions": ["manage_members", "manage_roles", ...]
    },
    "data": {
        "old_role": "member",
        "new_role": "admin"
    }
}

{
    "event": "organization.updated",
    "timestamp": "2026-03-19T15:00:00+00:00",
    "organization": {
        "uuid": "550e8400-...",
        "name": "Acme Corporation",
        "slug": "acme-corp",
        "description": "Updated description",
        "is_active": true
    },
    "data": {
        "name": "Acme Corporation"
    }
}

{
    "event": "role.created",
    "timestamp": "2026-03-19T15:10:00+00:00",
    "organization": {
        "uuid": "550e8400-...",
        "name": "Acme Corp",
        "slug": "acme-corp"
    },
    "role": {
        "id": 5,
        "name": "project-manager",
        "display_name": "Project Manager",
        "permissions": ["manage_members", "invite_members", "view_members"]
    }
}

{
    "event": "invitation.accepted",
    "timestamp": "2026-03-19T16:00:00+00:00",
    "organization": {
        "uuid": "550e8400-...",
        "name": "Acme Corp",
        "slug": "acme-corp"
    },
    "invitation": {
        "uuid": "inv-uuid-123",
        "email": "jane@example.com",
        "role": "member"
    }
}

import requests

KIGES_API = 'https://id.kiges.cc/api'

def get_user_with_orgs(access_token):
    """Fetch user profile and organizations in one call."""
    r = requests.get(f'{KIGES_API}/v1/me', headers={
        'Authorization': f'Bearer {access_token}',
        'Accept': 'application/json',
    })
    r.raise_for_status()
    return r.json()['data']

def get_org_members(access_token, org_uuid):
    """Fetch all members of an organization."""
    r = requests.get(f'{KIGES_API}/v1/organizations/{org_uuid}/members', headers={
        'Authorization': f'Bearer {access_token}',
        'Accept': 'application/json',
    })
    r.raise_for_status()
    return r.json()['data']

def check_user_permissions(access_token, org_uuid, permissions):
    """Check if the user has specific permissions in an organization."""
    r = requests.get(
        f'{KIGES_API}/v1/organizations/{org_uuid}/permissions',
        params={'permissions': ','.join(permissions)},
        headers={
            'Authorization': f'Bearer {access_token}',
            'Accept': 'application/json',
        }
    )
    r.raise_for_status()
    return r.json()['data']['checked']

# Usage
user = get_user_with_orgs(token)
for org in user['organizations']:
    print(f"Org: {org['name']}, Role: {org['role']}")
    perms = check_user_permissions(token, org['uuid'], ['manage_members', 'manage_billing'])
    print(f"  Can manage members: {perms['manage_members']}")
    print(f"  Can manage billing: {perms['manage_billing']}")

# Get user profile + organizations
curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://id.kiges.cc/api/v1/me

# List all organizations
curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://id.kiges.cc/api/v1/organizations

# Get organization details
curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://id.kiges.cc/api/v1/organizations/ORG_UUID

# List members
curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://id.kiges.cc/api/v1/organizations/ORG_UUID/members

# Check specific permissions
curl -H "Authorization: Bearer YOUR_TOKEN" \
     "https://id.kiges.cc/api/v1/organizations/ORG_UUID/permissions?permissions=manage_members,manage_billing"

# Invite a new member
curl -X POST \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"email":"jane@example.com","role":"member"}' \
     https://id.kiges.cc/api/v1/organizations/ORG_UUID/invitations

# Create a custom role
curl -X POST \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"name":"editor","display_name":"Editor","permissions":["view_members","invite_members"]}' \
     https://id.kiges.cc/api/v1/organizations/ORG_UUID/roles