current↗

DEVELOPER NOTES

Small demos.
Real protocols.

Use Current as your identity provider

Issuer: https://current.ai
Discovery: /.well-known/openid-configuration
OAuth metadata: /.well-known/oauth-authorization-server

Register your service, then use authorization code flow with S256 PKCE. Request openid profile email for OIDC, or profile for the OAuth-only demo. Use sub as the user identity, not the six-digit display ID. Tokens expire after ten minutes; sessions and refresh tokens after one hour.

Google Console

  1. Open Google Auth Platform in the project owning the OAuth credentials.
  2. In Branding, use Current, add current.ai as an authorized domain, and set the homepage to https://current.ai, privacy policy to https://current.ai/privacy, and terms to https://current.ai/terms. Provide the support and developer contact emails.
  3. In Audience, choose External. While Testing, add your Google account under Test users. Publish when you want other users to sign in.
  4. In Data Access, select only openid, .../auth/userinfo.email, and .../auth/userinfo.profile. No Gmail API or inbox permission is needed.
  5. In Clients, edit or create a Web application. Add the authorized redirect URI https://current.ai/auth/google/callback. Keep existing dima.ai redirects. This server redirect flow needs no JavaScript origin setting.
  6. Configure GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on the demos service, then restart it.

GitHub

Create an OAuth App in GitHub Settings → Developer settings → OAuth Apps. Homepage: https://current.ai. Authorization callback: https://current.ai/auth/github/callback. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET. A separate app preserves the existing dima.ai callback. The demo requests the read:user profile scope; it does not request repository access.

Okta or another OIDC provider

The built-in OIDC client runs against Current. To also connect an external provider, register a Web OIDC application there with callback https://current.ai/auth/enterprise/callback, and set ENTERPRISE_OIDC_ISSUER, ENTERPRISE_OIDC_CLIENT_ID, and ENTERPRISE_OIDC_CLIENT_SECRET. Use authorization code flow and client_secret_post authentication. The client discovers endpoints and validates state, PKCE, nonce, issuer, audience, expiry, the ID-token signature, and the UserInfo subject.

Connect an MCP client

Streamable HTTP endpoint: https://current.ai/mcp. No auth. Tools: assign_color with a name, and latest_colors. Resource: current://colors/latest. All submissions are public; the latest five are retained.

{
  "mcpServers": {
    "current-colors": {
      "url": "https://current.ai/mcp"
    }
  }
}

Standards and verification

The server uses oidc-provider, an OpenID Certified implementation, configured for authorization code flow, discovery, JWKS, UserInfo, registration, revocation, introspection, refresh tokens, and RP-initiated logout. The client uses openid-client. Current's deployment has not itself been OpenID certified. See the repository verification guide for local interoperability tests and how to run the OpenID Foundation conformance suite.