Hanzo ID - Identity & Authentication

// Start auth flow
const authUrl = new URL("https://hanzo.id/oauth/authorize")
authUrl.searchParams.set("response_type", "token")  // implicit flow
authUrl.searchParams.set("client_id", "app-hanzo")
authUrl.searchParams.set("redirect_uri", "https://myapp.com/callback")
authUrl.searchParams.set("scope", "openid profile email")
authUrl.searchParams.set("state", crypto.randomUUID())

window.location.href = authUrl.toString()

// On callback page
const hash = new URLSearchParams(window.location.hash.substring(1))
const accessToken = hash.get("access_token")
const state = hash.get("state")

// Get full profile (userinfo only returns sub)
const profile = await fetch("https://iam.hanzo.ai/api/get-account", {
  headers: { "Authorization": `Bearer ${accessToken}` }
}).then(r => r.json())
// profile.name, profile.email, profile.avatar, etc.

// ALWAYS use this before login — source of truth for app/org
const appLogin = await fetch("https://hanzo.id/api/get-app-login", {
  method: "POST",
  body: JSON.stringify({ clientId: "app-hanzo" })
}).then(r => r.json())

// Use appLogin.application and appLogin.organization
// Do NOT hardcode organization: "hanzo" — breaks scoped SSO

hanzo.id (login UI)
├── org: hanzo    → app-hanzo, app-console, app-platform
├── org: lux      → app-lux-cloud, app-lux-explorer
├── org: zoo      → app-zoo-gym
└── org: pars     → app-pars