OASIS
startupoasis.com
Enter Oasis
For app builders

One founder identity. Every app you ship.

Oasis is an OpenID Connect identity provider. Add "Sign in with Oasis" to any Lovable project and every user arrives with their canonical profile, memory, and signal history — ready to write back to the hub.

01

Register your app

Ask the Oasis team to add your app to the client registry. You'll get a client_id, client_secret, and can list the redirect URIs your app uses.

02

Add the OIDC flow

Standard authorization-code + PKCE against the Oasis issuer. Verify the ID token against Oasis's JWKS and use the sub claim as the user's canonical id.

03

Write back to the hub

Use the returned access token as a bearer to call the Oasis Hub API for signals, memory, and artifacts. Everything flows into the founder's headquarters.

OIDC discovery

Point your OAuth client here

Issuer
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1
Discovery document
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/.well-known/openid-configuration
JWKS
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/.well-known/jwks.json
Scopes

Ask for only what you need

Request only openid email profile at the issuer — those are the scopes it mints. First-party Suite apps inherit their hub:* scopes from the Oasis app registry automatically.

ScopeWhat it grants
openidVerify who the user is (returns an ID token).
emailSee the user's email address.
profileDisplay name and avatar.
hub:signals.writeEmit activity events into the founder's Oasis feed and Founder Index.
hub:memory.readRead the founder's shared AI memory for personalization.
hub:memory.writeSave new memory entries the copilot on every app can reason over.
hub:artifacts.readList files the founder has stored in the Oasis vault.
hub:artifacts.writeSave files (pitches, assessments, decks) into the Oasis vault.
Hub API

Everything writes back to the founder's headquarters

GET/api/public/hub/v1/me

Canonical identity, display name, avatar, linked apps.

Requires openid

POST/api/public/hub/v1/signals

Record an event that flows into the activity feed and Founder Index.

Requires hub:signals.write

GET/api/public/hub/v1/memory

Read the founder's cross-app AI memory.

Requires hub:memory.read

POST/api/public/hub/v1/memory

Write a memory entry every Oasis copilot can reason over.

Requires hub:memory.write

GET/api/public/hub/v1/artifacts

List the founder's stored artifacts filtered by app or kind.

Requires hub:artifacts.read

POST/api/public/hub/v1/artifacts

Store a new artifact (deck, assessment, generated asset).

Requires hub:artifacts.write

End-to-end example

From redirect to first signal

The full flow a sister app runs the first time a founder clicks “Sign in with Oasis.” Substitute YOUR_CLIENT_ID, YOUR_CLIENT_SECRET, and your registered redirect URI.

1 · Send the user to Oasis
Authorization URL (browser redirect)
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://your-app.lovable.app/auth/callback
  &scope=openid%20email%20profile
  &state=<random>
  &code_challenge=<pkce-s256>
  &code_challenge_method=S256
2 · Exchange the code for tokens
POST /oauth/token
curl -X POST "https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "grant_type=authorization_code" \
  -d "code=<code from callback>" \
  -d "redirect_uri=https://your-app.lovable.app/auth/callback" \
  -d "code_verifier=<pkce-verifier>"

# → { access_token, id_token, refresh_token, expires_in, token_type: "Bearer" }
3 · Hydrate the founder's profile
GET /api/public/hub/v1/me
curl "https://startupoasis.com/api/public/hub/v1/me" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

# → { canonical_id, display_name, email, avatar_url, linked_apps: [...] }
4 · Emit a signal when something meaningful happens
POST /api/public/hub/v1/signals
curl -X POST "https://startupoasis.com/api/public/hub/v1/signals" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "compass.assessment_completed",
    "payload": { "axis": "gtm", "score": 72 },
    "weight": 1.5
  }'

# The signal flows into Foundation's Entrepreneurial Transcript,
# updates the Founder Index, and feeds the copilot's context.
5 · Store an artifact (deck, transcript, export)
POST /api/public/hub/v1/artifacts
curl -X POST "https://startupoasis.com/api/public/hub/v1/artifacts" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "pitch_deck",
    "title": "Seed round v3",
    "url": "https://your-app.lovable.app/decks/abc",
    "meta": { "audience": "investors" }
  }'
Best practices
  • Always include a stable payload.source_event_id on writes so retries don't double-count in Foundation.
  • Access tokens are short-lived. Use the refresh token server-side; never expose it to the browser.
  • Ask for the smallest scope set that works. Users can revoke your app from their Oasis headquarters.
  • Signals should describe what happened (roadmap.item_shipped), not UI actions (button_clicked).
Reference integration

Compass: matching a returning founder to their existing account

Compass is the first Suite app on Oasis sign-in. Its callback is /founder/auth/oasis/callback and its authorization request asks for openid email profile. The important part is what happens after the token exchange: never guess the account from the email alone.

Resolve the existing app account from /hub/v1/me
const me = await fetch(`${HUB}/api/public/hub/v1/me`, {
  headers: { Authorization: `Bearer ${access_token}` },
}).then((r) => r.json());

// linked_apps is written by the Oasis migration — the alias points at the
// exact user id that already holds this founder's history in your app.
const alias = (me.linked_apps ?? []).find((a) => a.source_app === "compass");
let userId = alias?.source_user_id ?? null;

if (!userId) userId = await findUserByVerifiedEmail(me.email); // fallback
if (!userId) userId = await createUser(me);                    // brand-new founder

Full checklist — button, callback, token-exchange function, session handling, and the event conventions — lives in docs/integrations/compass.md.

Suite registry

Every Prepare 4 VC app and how it connects

CompassFounder sign-incompass

Assessment, diagnosis and next-move recommendation. Writes signals, pitch readiness and assessment artifacts.

Callback /founder/auth/oasis/callback

Prepare 4 VCFounder sign-inprepare4vc

Public site, programs and applications. One account across the marketing site and the Suite.

Callback /auth/oasis/callback

Precision Pitch PracticeFounder sign-inpitch-practice

Rehearsal and delivery coaching. Writes practice signals and session artifacts.

Callback /auth/oasis/callback

Rate My PitchFounder sign-inrate-my-pitch

Structured pitch scoring that feeds Oasis pitch readiness per audience.

Callback /auth/oasis/callback

Product Lab AcceleratorFounder sign-inproduct-lab

Build sprints and milestones that land as roadmap suggestions in Founder HQ.

Callback /auth/oasis/callback

Program CommandStaff sign-in + service keyprogram-command

Cohort operations. Staff sign in with Oasis; roster reads use a service key.

Callback /auth/oasis/callback

Astra Outreach ConsoleStaff sign-in + service keyastra

Internal action queues and briefs. Read-only against the hub; HubSpot stays the CRM.

Callback /auth/oasis/callback

Core FoundationService key onlycore-foundation

Approved doctrine and playbooks pushed into the Oasis corpus as read-only reference artifacts.

Callback n/a — server-to-server

Staff tools

Service keys for internal consoles

Program Command and Astra also need roster-level reads that are not tied to a single founder session. Those calls use a revocable service key sent as x-oasis-service-key — never a founder access token.

Roster and founder summary
curl -H "x-oasis-service-key: $OASIS_SERVICE_KEY" \
  https://startupoasis.com/api/public/hub/v1/founders

curl -H "x-oasis-service-key: $OASIS_SERVICE_KEY" \
  https://startupoasis.com/api/public/hub/v1/founders/CANONICAL_ID

The summary returns identity, linked apps, latest Compass axes and stage, Founder Index components, pitch readiness, recent signals and open claims. It never returns artifact contents or private memory bodies.

Building something on Lovable?

Register your app with Oasis and give your users one profile across the entire ecosystem.

Building the first-party Compass integration? The full copy-paste checklist lives at docs/integrations/compass.md.

Register an app →Breakthrough ingestion contract →Back to Oasis