How to add Sign in with ChatGPT to your app

import { cookies } from "next/headers";
import { redirect } from "next/navigation";

const AUTHORIZE = "https://auth.openai.com/api/accounts/authorize";
const b64url = (bytes: Uint8Array) => Buffer.from(bytes).toString("base64url");
const random = () => b64url(crypto.getRandomValues(new Uint8Array(32)));

export async function GET() {
  // Fresh one-time transaction per sign-in; expires after 10 minutes.
  const state = random();
  const nonce = random();
  const verifier = random();
  const challenge = b64url(
    new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))),
  );

  (await cookies()).set("siwc_tx", JSON.stringify({ state, nonce, verifier }), {
    httpOnly: true,
    secure: true,
    sameSite: "lax",
    maxAge: 600,
    path: "/auth/chatgpt",
  });

  const url = new URL(AUTHORIZE);
  url.search = new URLSearchParams({
    response_type: "code",
    client_id: process.env.OPENAI_CLIENT_ID!, // oaiapp_...
    redirect_uri: process.env.OPENAI_REDIRECT_URI!, // must match the registered callback exactly
    scope: "openid profile email",
    state,
    nonce,
    code_challenge: challenge,
    code_challenge_method: "S256",
  }).toString();

  redirect(url.toString());
}

import { cookies } from "next/headers";
import { createRemoteJWKSet, jwtVerify } from "jose";

const TOKEN = "https://auth.openai.com/api/accounts/oauth/token";
const JWKS = createRemoteJWKSet(new URL("https://auth.openai.com/.well-known/jwks.json"));

export async function GET(req: Request) {
  const params = new URL(req.url).searchParams;
  const jar = await cookies();
  const tx = jar.get("siwc_tx")?.value;
  jar.delete({ name: "siwc_tx", path: "/auth/chatgpt" }); // consume the transaction once

  if (!tx || params.get("error")) return new Response("Sign-in failed", { status: 400 });
  const { state, nonce, verifier } = JSON.parse(tx);
  if (params.get("state") !== state) return new Response("Invalid state", { status: 400 });

  const res = await fetch(TOKEN, {
    method: "POST",
    headers: {
      "content-type": "application/x-www-form-urlencoded",
      // Confidential client: HTTP Basic auth. Never put the secret in the form body.
      // (Public clients omit this header.)
      authorization:
        "Basic " + btoa(`${process.env.OPENAI_CLIENT_ID}:${process.env.OPENAI_CLIENT_SECRET}`),
    },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code: params.get("code")!,
      redirect_uri: process.env.OPENAI_REDIRECT_URI!,
      client_id: process.env.OPENAI_CLIENT_ID!,
      code_verifier: verifier,
    }),
  });
  if (!res.ok) return new Response("Token exchange failed", { status: 502 });
  const { id_token } = await res.json();

  // Verify signature (JWKS), issuer, audience and expiry, then the nonce.
  const { payload } = await jwtVerify(id_token, JWKS, {
    issuer: "https://auth.openai.com",
    audience: process.env.OPENAI_CLIENT_ID!,
  });
  if (payload.nonce !== nonce) return new Response("Invalid nonce", { status: 400 });

  // payload.sub is the stable ChatGPT identity. Link or create your user,
  // then issue your own HttpOnly, Secure, SameSite=Lax session cookie.
  // linkOrCreateUser and startSession are your app's own functions.
  const user = await linkOrCreateUser({ sub: payload.sub!, email: payload.email as string | undefined });
  await startSession(user);
  return Response.redirect(new URL("/", req.url));
}

import { createHash, randomBytes, randomUUID } from "node:crypto";

const b64url = (buf: Buffer) => buf.toString("base64url");
const verifier = b64url(randomBytes(32));
const state = b64url(randomBytes(16));
const nonce = b64url(randomBytes(16));
const port = 1455; // any free port; path must be /callback on 127.0.0.1

// Generate once per host (laptop, VM) and persist it. Reuse it on every sign-in.
const hostId = loadHostId() ?? saveHostId(`urn:uuid:${randomUUID()}`);

const url = new URL("https://auth.openai.com/api/accounts/authorize");
url.search = new URLSearchParams({
  client_id: "dynamic_agent_client", // first sign-in only; reuse the issued client ID afterwards
  agent_name_hint: "My Agent", // your app's real name, the same on every install
  ext_agent_host_id: hostId,
  response_type: "code",
  redirect_uri: `http://127.0.0.1:${port}/callback`, // never "localhost"
  scope: "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct",
  resource: "https://api.openai.com/v1",
  state,
  nonce,
  code_challenge_method: "S256",
  code_challenge: b64url(createHash("sha256").update(verifier).digest()),
}).toString();

// Open url in the user's browser, listen on 127.0.0.1:${port}/callback,
// check state, then exchange the code (no client secret).

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-6.1-sol",
    "input": [{"role": "user", "content": "Say exactly: Hello, world!"}],
    "store": false,
    "stream": true
  }'

curl https://api.openai.com/v1/models \
  -H "Authorization: Bearer $ACCESS_TOKEN"