# Done ID for partner apps
Done ID is the login service and SSO provider for Done Products. Each app that connects becomes part of the Done product catalogue and uses Done ID to sign in users and to get access tokens. Done ID uses OpenID Connect (OIDC) and OAuth 2.0, so you can use a standard OIDC library for your platform.

These pages tell you how to get a client for your app, how to get tokens, and what the tokens contain.

## Integration types

A client is the record in Done ID that identifies your app. You get one client for each app and each environment. Pick the type that matches how your app runs:

| Type | Use it when | OAuth flow | Client secret |
|---|---|---|---|
| Machine to machine | Your backend calls the Done OS API on its own behalf. No user signs in. | Client credentials | Yes |
| Server-side login | Users sign in to a web app that has a backend that can keep a secret. | Authorization code | Yes |
| Browser or mobile login | Users sign in to a single-page app (SPA) or a mobile app. The app cannot keep a secret. | Authorization code with PKCE | No |

PKCE (Proof Key for Code Exchange) is an extension to the authorization code flow. It protects apps that cannot keep a secret.

If your app has a login and also calls the Done OS API from its backend without a user, you need two clients.

If your app runs its own onboarding and sends users to Done OS only to create the account, your backend can also create a registration session with a machine-to-machine client. After the user verifies the email address, Done OS sends the user back to your app. See [User accounts and email verification](/user-accounts#send-users-back-to-your-app-after-registration).

## Environments

| Environment | Done ID host | Issuer |
|---|---|---|
| Sandbox | `https://id.sandbox.done.ai` | `https://id.sandbox.done.ai/realms/done` |
| Production | `https://id.done.ai` | `https://id.done.ai/realms/done` |

Start in sandbox. You get production credentials after your integration works in sandbox.

Each issuer publishes its OIDC configuration (discovery document). Most OIDC libraries need only this URL:

| Environment | Discovery document |
|---|---|
| Sandbox | `https://id.sandbox.done.ai/realms/done/.well-known/openid-configuration` |
| Production | `https://id.done.ai/realms/done/.well-known/openid-configuration` |

The discovery document gives these endpoints. The paths are the same in both environments:

| Endpoint | Path under the issuer |
|---|---|
| Authorization | `/protocol/openid-connect/auth` |
| Token | `/protocol/openid-connect/token` |
| User info | `/protocol/openid-connect/userinfo` |
| Logout | `/protocol/openid-connect/logout` |
| Signing keys (JWKS) | `/protocol/openid-connect/certs` |
| Token introspection | `/protocol/openid-connect/token/introspect` |
| Token revocation | `/protocol/openid-connect/revoke` |

The discovery document lists more grant types, for example `implicit` and `password`. Partner clients cannot use them. Use only the flows on these pages.

## Steps to integrate

1. Read the pages for your integration type and decide what your app needs.
2. Request a client. See [Request a client](/request-a-client).
3. Build and test the integration in sandbox.
4. Request a production client with the same procedure.

## Pages

- [Request a client](/request-a-client)
- [Machine to machine](/machine-to-machine)
- [User login](/user-login)
- [Tokens](/tokens)
- [User accounts and email verification](/user-accounts)