Skip to Content
Valyd IDIntroduction

Valyd Third-Party SSO API

Agent Quick-Start

  • Source URL: https://docs.valyd.work/docs/overview 
  • Credentials / env vars needed: client_id, client_secret (obtain from the Developer Portal — see Prerequisites)
  • Files an integrator edits: none — reference / orientation page only
  • Estimated steps: 6 (the end-to-end OAuth2 SSO flow described below)
  • Can complete without human input: NO — obtaining credentials requires signing up at https://dev.valyd.work  and creating a project (a human-only web step)
  • Prerequisites:
    • A basic Valyd account (sign up at https://dev.valyd.work  — no KYC verification required)
    • A registered project in the Developer Portal that provides your client_id and client_secret
    • A backend capable of making server-side HTTPS requests (to keep client_secret secret)

Integrate secure identity verification and authentication into your application using Valyd’s OAuth2-based Single Sign-On system. Get access to verified user profiles, professional licenses, and identity verification data.

Base URL

https://idp.valyd.work/api/auth/tpsso

Integration Flow

Access to the Developer Portal requires a basic Valyd account. No KYC verification needed — just sign up at https://dev.valyd.work  to get your API credentials.

The end-to-end OAuth2 SSO flow has six steps:

  1. Create Project — Register your application at https://dev.valyd.work  to get your client credentials (client_id and client_secret).
  2. Redirect to Authorization — When a user clicks “Login with Valyd”, redirect them to the authorization URL with your client_id and requested scopes.
  3. User Consent — The user sees the consent screen with the requested permissions and approves access.
  4. Receive Authorization Code — After approval, the user is redirected to your callback URL with a one-time code (valid for 5 minutes).
  5. Exchange Code for Tokens — Your backend exchanges the code for an access_token and refresh_token using your client_secret.
  6. Access Protected Resources — Use the access_token to call /userinfo, /licenses, and /verifications endpoints.

Authorization URL shape

The authorization URL is built from the IdP base host https://idp.valyd.work, the /auth path, and query parameters. scope is a space-separated list, URL-encoded.

https://idp.valyd.work/auth?client_id=YOUR_CLIENT_ID&redirect_url=YOUR_REDIRECT_URI&scope=profile%20verifications
  • YOUR_CLIENT_ID — get this from the Developer Portal → your project → Credentials: https://dev.valyd.work 
  • YOUR_REDIRECT_URI — the Redirect URL you registered for the project in the Developer Portal (must NOT end with a trailing slash)
  • scope — space-separated scope list (e.g. profile verifications zkp), URL-encoded so the space becomes %20

Security Notes

  • Keep your client_secret server-side only — never expose it in frontend code.

  • access_token is short-lived (15 minutes); refresh_token is longer-lived.

    Note: the component lists access_token as “short-lived (15 minutes)” in the Security Notes, while the Integration Flow text describes it generically as “short-lived”. 15 minutes is the explicit value given.

  • Always use HTTPS for all API calls.

  • Store tokens securely and never log them in production.

Developer Tools

The live documentation page includes a Postman Collection generator widget for exploring these endpoints interactively. It is a UI convenience and produces a Postman collection for the same endpoints described here; there is no additional API surface beyond the endpoints listed above.

Quick start