Integration guide overview
The four groups inside the integration guide, how the pages depend on each other, the suggested three-stage order, and what the guide does and does not cover.
The integration guide is written for a third-party application doing its first integration: from registering credentials to holding a working token, with every step verifiable on its own. It is not a history of the protocol and not a description of internals — only "what you do, and how you confirm it worked".
This page explains what the section contains, how the pages relate, and in what order to read them.
What it covers
| Group | Pages | Problem it solves |
|---|---|---|
| Getting started | Registering a client, Quick start, Discovery | Obtain client_id, learn the endpoints, run one complete flow |
| Authorization flows | Authorization code flow, Token endpoint, Token exchange | Every detail from the browser redirect to a landed token |
| Permissions and security | Scopes and audiences, Redirect URI policy, Authentication strength, Authorization details | Where the boundaries are once you hold a token |
| Reference | Endpoint index, Tokens, Error codes | Look-up pages, no need to read in order |
How the pages relate
The authorization code flow is the spine; everything else hangs off it:
- Registering a client → credentials and a registered redirect URI;
- Authorization code flow → browser redirect, consent page, callback validation;
- Token endpoint → exchanging the code for a token, and refreshing later;
- Tokens → what the token looks like and how to validate it.
Two pages cut across the rest and can be consulted at any time: Discovery decides where your endpoints come from in code, and Error codes decides where to look when something fails.
Suggested order
| Stage | What you do | What to read |
|---|---|---|
| Get it running | Complete one authorization code flow in fifteen minutes, obtain a token, call UserInfo | Registering a client → Quick start |
| Make it solid | Add PKCE validation, the redirect allow-list, token validation and refresh | Authorization code flow → Token endpoint → Tokens |
| Draw the boundaries | Confirm scopes and audience, handle step-up and denial | Scopes and audiences → Redirect URI policy → Authentication strength |
Do not skip the first stage and read the third. Many conclusions about security boundaries only make sense after you have run a flow yourself: before that, "the audience is wrong" is four words; after, it is a 401 you have actually seen.
What you can do afterwards
- Your application can sign users in with MuoCeon and hold a verifiable token;
- You know why each parameter is required and which step each error code indicates;
- You know which capabilities are closed to third parties (token exchange, fine-grained authorization) and will not waste time on them.
What it does not cover
- Developer platform walkthroughs: the platform is not live; registration is manual for now, see Registering a client;
- MuoCeon internals: no table schemas, cache keys or internal call chains;
- Non-OAuth account APIs (profile management, grant records): these belong to the API reference section, see API reference overview;
- End-user explanations: what the consent page asks and how to revoke access, see FAQ overview.
Common misconceptions
| Misconception | Reality |
|---|---|
| Copying the domain from an example into code | Domains vary per deployment; read endpoints from discovery |
| Assuming every requested scope is granted | The server silently trims by client capability; trust scope in the response |
| Using implicit flow or password grant to save effort | Third parties have exactly one path: authorization code + PKCE (S256) |
Shipping client_secret inside a mobile binary | Register a web_client / desktop client instead; secrets never go in clients |
Documentation outline
The whole of the MuoCeon developer docs — purpose, audience, sections, section guides, reading paths and conventions.
API reference overview
How API reference differs from the integration guide, how it is organised by version and context, how to read parameter tables, and what is available today.