One founder identity. Every app you ship.
Oasis is an OpenID Connect identity provider. Add "Sign in with Oasis" to any Lovable project and every user arrives with their canonical profile, memory, and signal history — ready to write back to the hub.
Register your app
Ask the Oasis team to add your app to the client registry. You'll get a client_id, client_secret, and can list the redirect URIs your app uses.
Add the OIDC flow
Standard authorization-code + PKCE against the Oasis issuer. Verify the ID token against Oasis's JWKS and use the sub claim as the user's canonical id.
Write back to the hub
Use the returned access token as a bearer to call the Oasis Hub API for signals, memory, and artifacts. Everything flows into the founder's headquarters.
Point your OAuth client here
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/.well-known/openid-configuration
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/.well-known/jwks.json
Ask for only what you need
Request only openid email profile at the issuer — those are the scopes it mints. First-party Suite apps inherit their hub:* scopes from the Oasis app registry automatically.
| Scope | What it grants |
|---|---|
| openid | Verify who the user is (returns an ID token). |
| See the user's email address. | |
| profile | Display name and avatar. |
| hub:signals.write | Emit activity events into the founder's Oasis feed and Founder Index. |
| hub:memory.read | Read the founder's shared AI memory for personalization. |
| hub:memory.write | Save new memory entries the copilot on every app can reason over. |
| hub:artifacts.read | List files the founder has stored in the Oasis vault. |
| hub:artifacts.write | Save files (pitches, assessments, decks) into the Oasis vault. |
Everything writes back to the founder's headquarters
/api/public/hub/v1/meCanonical identity, display name, avatar, linked apps.
Requires openid
/api/public/hub/v1/signalsRecord an event that flows into the activity feed and Founder Index.
Requires hub:signals.write
/api/public/hub/v1/memoryRead the founder's cross-app AI memory.
Requires hub:memory.read
/api/public/hub/v1/memoryWrite a memory entry every Oasis copilot can reason over.
Requires hub:memory.write
/api/public/hub/v1/artifactsList the founder's stored artifacts filtered by app or kind.
Requires hub:artifacts.read
/api/public/hub/v1/artifactsStore a new artifact (deck, assessment, generated asset).
Requires hub:artifacts.write
From redirect to first signal
The full flow a sister app runs the first time a founder clicks “Sign in with Oasis.” Substitute YOUR_CLIENT_ID, YOUR_CLIENT_SECRET, and your registered redirect URI.
https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/oauth/authorize ?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri=https://your-app.lovable.app/auth/callback &scope=openid%20email%20profile &state=<random> &code_challenge=<pkce-s256> &code_challenge_method=S256
curl -X POST "https://iwmgwcmxndoifzphrdep.supabase.co/auth/v1/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "grant_type=authorization_code" \
-d "code=<code from callback>" \
-d "redirect_uri=https://your-app.lovable.app/auth/callback" \
-d "code_verifier=<pkce-verifier>"
# → { access_token, id_token, refresh_token, expires_in, token_type: "Bearer" }curl "https://startupoasis.com/api/public/hub/v1/me" \
-H "Authorization: Bearer $ACCESS_TOKEN"
# → { canonical_id, display_name, email, avatar_url, linked_apps: [...] }curl -X POST "https://startupoasis.com/api/public/hub/v1/signals" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"event_type": "compass.assessment_completed",
"payload": { "axis": "gtm", "score": 72 },
"weight": 1.5
}'
# The signal flows into Foundation's Entrepreneurial Transcript,
# updates the Founder Index, and feeds the copilot's context.curl -X POST "https://startupoasis.com/api/public/hub/v1/artifacts" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"kind": "pitch_deck",
"title": "Seed round v3",
"url": "https://your-app.lovable.app/decks/abc",
"meta": { "audience": "investors" }
}'- Always include a stable
payload.source_event_idon writes so retries don't double-count in Foundation. - Access tokens are short-lived. Use the refresh token server-side; never expose it to the browser.
- Ask for the smallest scope set that works. Users can revoke your app from their Oasis headquarters.
- Signals should describe what happened (
roadmap.item_shipped), not UI actions (button_clicked).
Compass: matching a returning founder to their existing account
Compass is the first Suite app on Oasis sign-in. Its callback is /founder/auth/oasis/callback and its authorization request asks for openid email profile. The important part is what happens after the token exchange: never guess the account from the email alone.
const me = await fetch(`${HUB}/api/public/hub/v1/me`, {
headers: { Authorization: `Bearer ${access_token}` },
}).then((r) => r.json());
// linked_apps is written by the Oasis migration — the alias points at the
// exact user id that already holds this founder's history in your app.
const alias = (me.linked_apps ?? []).find((a) => a.source_app === "compass");
let userId = alias?.source_user_id ?? null;
if (!userId) userId = await findUserByVerifiedEmail(me.email); // fallback
if (!userId) userId = await createUser(me); // brand-new founderFull checklist — button, callback, token-exchange function, session handling, and the event conventions — lives in docs/integrations/compass.md.
Building something on Lovable?
Register your app with Oasis and give your users one profile across the entire ecosystem.
Building the first-party Compass integration? The full copy-paste checklist lives at docs/integrations/compass.md.