· API

curl -X GET https://id.tokenpay.space/api/v1/users/me \
  -H "Authorization: Bearer tpid_sk_your_secret_key" \
  -H "Content-Type: application/json"

Authorization: Bearer tpid_sk_ваш_секретный_ключ

Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1678886400

{
  "error": {
    "code": "invalid_token",
    "message": "The access token is invalid or expired",
    "status": 401
  }
}

https://id.tokenpay.space/api/v1/oauth/authorize?
  client_id=tpid_pk_your_public_key&
  redirect_uri=https://yourapp.com/callback&
  response_type=code&
  scope=profile email&
  state=random_csrf_token&
  prompt=login&
  code_challenge=SHA256_HASH&
  code_challenge_method=S256

curl -X POST https://id.tokenpay.space/api/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "abc123...",
    "client_id": "tpid_pk_...",
    "client_secret": "tpid_sk_...",
    "redirect_uri": "https://yourapp.com/callback",
    "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
  }'

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "tpid_rt_8a7b6c5d...",
  "scope": "profile email",
  "user": {
    "id": "tpid_usr_a1b2c3d4",
    "email": "user@example.com",
    "name": "Alex Example",
    "email_verified": true
  }
}

curl -X GET https://tokenpay.space/api/v1/oauth/userinfo \
  -H "Authorization: Bearer ACCESS_TOKEN"

{
  "id": "tpid_usr_a1b2c3d4e5f6",
  "email": "user@example.com",
  "name": "Alex Example",
  "role": "user",
  "email_verified": true,
  "locale": "ru",
  "theme": "dark",
  "telegram_linked": true,
  "cupol_balance": 150,
  "cupol_subscription_active": true,
  "created_at": "2026-01-15T12:00:00Z"
}

{
  "provider": "TOKEN PAY ID",
  "widget_url": "https://tokenpay.space/sdk/tpid-widget.js",
  "widget_version": "1.2.0",
  "icon": { "shield_svg": "<svg ...>" },
  "buttons": {
    "standard": { "label": "Войти через TOKEN PAY", ... },
    "icon": { "shape": "circle", ... },
    "logo": { "background": "transparent", ... }
  },
  "integration": {
    "quick_start": "<script src=... data-client-id=...>",
    "oauth_popup": "TPID.loginWithOAuth().then(...);"
  },
  "themes": ["dark", "light", "auto"],
  "languages": ["ru", "en"]
}

{
  "client_id": "tpid_pk_...",
  "client_secret": "tpid_sk_...",
  "client_name": "My App",
  "redirect_uris": ["https://myapp.com/callback"],
  "client_type": "public",
  "registration_access_token": "Bearer ..."
}

{
  "client_id": "tpid_pk_...",
  "client_name": "My App",
  "client_type": "public",
  "redirect_uris": ["https://myapp.com/callback"],
  "client_uri": "https://myapp.com",
  "logo_uri": null,
  "tos_uri": null,
  "policy_uri": null,
  "scope": "openid,profile,email"
}

{
  "id": "tpid_usr_a1b2c3d4",
  "email": "user@example.com",
  "name": "Alex Example",
  "email_verified": true,
  "two_factor_enabled": false,
  "telegram_linked": true,
  "created_at": "2025-01-15T10:30:00Z",
  "last_login": "2026-03-13T09:45:00Z"
}

{
  "sessions": [
    {
      "id": "ses_abc123",
      "device": "Chrome — Windows",
      "ip": "192.168.1.1",
      "location": "Saint Petersburg, RU",
      "last_active": "2026-03-13T12:00:00Z",
      "current": true
    }
  ]
}

{
  "success": true,
  "message": "Verification code sent",
  "expires_in": 600
}

{
  "valid": true,
  "user_id": "tpid_usr_a1b2c3d4",
  "email": "user@example.com",
  "scopes": ["profile", "email"],
  "expires_at": 1678886400
}

{
  "requires_email_code": true,
  "requires_2fa": false,
  "message": "Verification code sent to your email"
}

{
  "sessionId": "uuid-...",
  "ttl": 300,
  "qrUrl": "https://tokenpay.space/qr-login?sid=uuid-..."
}

X-TPID-Signature: t=1711000000,v1=hmac_sha256_hex

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const parts = {};
  signature.split(',').forEach(p => {
    const [k, v] = p.split('=');
    parts[k] = v;
  });
  const expected = crypto
    .createHmac('sha256', secret)
    .update(parts.t + '.' + JSON.stringify(body))
    .digest('hex');
  return parts.v1 === expected;
}

{
  "event": "user.login",
  "timestamp": "2026-03-13T12:00:00Z",
  "data": {
    "user_id": "tpid_usr_a1b2c3d4",
    "ip": "192.168.1.1",
    "device": "Chrome — Windows"
  }
}

{
  "notifications": [
    { "id": "...", "type": "oauth_connect", "title": "New user connected", "body": "user@example.com authorized via OAuth", "is_read": false, "created_at": "2026-04-02T12:00:00Z" }
  ],
  "unread": 3
}

const es = new EventSource('/api/v1/notifications/stream?token=' + token);
es.addEventListener('notification', e => {
  const data = JSON.parse(e.data);
  console.log(data.event, data.data.title);
});
es.addEventListener('connected', e => {
  console.log('SSE connected', JSON.parse(e.data));
});

<script src="https://tokenpay.space/sdk/tpid-widget.js"
        data-client-id="tpid_pk_ваш_ключ"></script>

<!-- Стандартная кнопка -->
<div data-tpid-button="standard"></div>

<!-- Круглая иконка -->
<div data-tpid-button="icon"></div>

<!-- Логотип без фона -->
<div data-tpid-button="logo"></div>

TPID.loginWithOAuth({ prompt: 'login' })
  .then(function(result) {
    console.log('Auth code:', result.code);
    console.log('State:', result.state);
    // Отправьте code на ваш сервер для обмена на токен
  })
  .catch(function(err) {
    console.error('OAuth error:', err);
  });

<!-- Прямоугольная кнопка с текстом -->
<script src="https://tokenpay.space/sdk/tpid-auth.js"
        data-client-id="tpid_pk_ваш_ключ"
        data-redirect-uri="https://ваш-сайт.com/callback"
        data-mode="logo"
        data-theme="dark"
        data-size="medium"
        data-lang="ru">
</script>

<!-- Круглая иконка -->
<script src="https://tokenpay.space/sdk/tpid-auth.js"
        data-client-id="tpid_pk_ваш_ключ"
        data-redirect-uri="https://ваш-сайт.com/callback"
        data-mode="icon"
        data-theme="light"
        data-size="large">
</script>

// Инициализация
TokenPayAuth.init({
  clientId: 'tpid_pk_ваш_ключ',
  redirectUri: 'https://ваш-сайт.com/callback',
  theme: 'dark',
  locale: 'ru',
  onSuccess: function(data) {
    console.log('Код:', data.code);
    console.log('Verifier:', data.codeVerifier);
    // Отправьте code + codeVerifier на ваш сервер
  }
});

// Рендер кнопки в контейнер
TokenPayAuth.renderButton('#my-container', {
  mode: 'button', // 'button' | 'icon'
  theme: 'dark',   // 'dark' | 'light' | 'auto'
  size: 'medium',  // 'small' | 'medium' | 'large'
  locale: 'ru'
});

// Или запуск OAuth вручную (PKCE генерируется автоматически)
TokenPayAuth.authorize();

// Получить code_verifier для серверного обмена
const verifier = TokenPayAuth.getCodeVerifier();

curl -X POST https://tokenpay.space/api/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "tpid_code_...",
    "client_id": "tpid_pk_...",
    "client_secret": "tpid_sk_...",
    "redirect_uri": "https://ваш-сайт.com/callback",
    "code_verifier": "PKCE_VERIFIER"
  }'

curl -X GET https://tokenpay.space/api/v1/oauth/userinfo \
  -H "Authorization: Bearer ACCESS_TOKEN"

{
  "id": "tpid_usr_a1b2c3d4e5f6",
  "email": "user@example.com",
  "name": "Alex Example",
  "email_verified": true,
  "created_at": "2026-01-15T12:00:00Z"
}

pip install tokenpay-id

from tokenpay_id import TokenPayID

client = TokenPayID(
    client_id="tpid_pk_your_public_key",
    client_secret="tpid_sk_your_secret_key"
)

# Verify a user's token
result = client.verify(access_token)
print(result.user_id)  # tpid_usr_...

# Get user profile
user = client.get_user(access_token)
print(user.email)  # user@example.com

# Webhook signature verification
is_valid = client.verify_webhook(
    payload=request.body,
    signature=request.headers["X-TPID-Signature"]
)

go get github.com/tokenpay/id-go

package main

import (
    tpid "github.com/tokenpay/id-go"
)

func main() {
    client := tpid.NewClient(tpid.Config{
        ClientID:     "tpid_pk_your_public_key",
        ClientSecret: "tpid_sk_your_secret_key",
    })

    // Verify token
    result, err := client.Verify(accessToken)
    if err != nil {
        log.Fatal(err)
    }
    fmt.Println(result.UserID) // tpid_usr_...
}

// 1. Dark pill (default) — for light app surfaces
TpidLoginButton(onResult = ::handleLogin)

// 2. Light pill — for dark app surfaces
TpidLoginButton(
    variant = TpidButtonVariant.LIGHT,
    onResult = ::handleLogin
)

// 3. Icon-only — for tab bars, FABs, compact areas
TpidLoginButton(
    variant = TpidButtonVariant.ICON_ONLY,
    onResult = ::handleLogin
)

// 1. curl -L -O https://tokenpay.space/sdk/android/tokenpay-id-android-2.6.0.tar.gz
// 2. tar -xzf tokenpay-id-android-2.6.0.tar.gz
// 3. In settings.gradle.kts:
include(":tokenpay-id-sdk")
project(":tokenpay-id-sdk").projectDir = file("sdk/android/tokenpay-id-sdk")

// In app/build.gradle.kts:
dependencies {
    implementation(project(":tokenpay-id-sdk"))
}

import space.tokenpay.id.TpidAuth
import space.tokenpay.id.TpidConfig
import space.tokenpay.id.TpidLoginButton
import space.tokenpay.id.TpidResult

// In Application.onCreate():
TpidAuth.initialize(
    context = applicationContext,
    config = TpidConfig(
        clientId = "tpid_pk_your_public_key",
        redirectUri = "com.cupol.vpn:/auth/callback",
        scopes = listOf("openid", "profile", "email"),
        theme = TpidConfig.Theme.AUTO,
    )
)

// In Compose — native widget opens in an Activity, no browser:
@Composable
fun LoginScreen() {
    TpidLoginButton { result ->
        when (result) {
            is TpidResult.Success -> navigate(result.accessToken)
            is TpidResult.Cancelled -> {}
            is TpidResult.Failure -> showError(result.error)
        }
    }
}

// Legacy — requires browser redirect via Custom Tab

import space.tokenpay.id.TokenPayID

val client = TokenPayID(
    clientId = "tpid_pk_your_public_key",
    clientSecret = "tpid_sk_your_secret_key",
    redirectUri = "myapp://callback"
)

// OAuth — открыть браузер
val authUrl = client.getAuthorizationUrl(
    scopes = listOf("profile", "email"),
    usePKCE = true
)
startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(authUrl)))

// Обработка callback в Activity
override fun onNewIntent(intent: Intent) {
    val code = intent.data?.getQueryParameter("code") ?: return
    lifecycleScope.launch {
        val tokens = client.exchangeCode(code)
        val user = client.getUserInfo(tokens.accessToken)
        Log.d("TPID", "User: ${user.name} (${user.email})")
    }
}

// Верификация токена на сервере
val result = client.verify(accessToken)
println(result.userId) // tpid_usr_...

// 1. curl -L -O https://tokenpay.space/sdk/swift/tokenpay-id-swift-2.6.0.tar.gz
// 2. shasum -a 256 -c tokenpay-id-swift-2.6.0.tar.gz.sha256
// 3. tar -xzf tokenpay-id-swift-2.6.0.tar.gz
// 4. Xcode → File → Add Package Dependencies… → Add Local…
//    Select the unpacked directory. Add "TokenPayID" product to your target.

// Or, in your own Package.swift:
dependencies: [
    .package(path: "./tokenpay-id-swift-2.6.0/sdk/swift")
]

import SwiftUI
import TokenPayID

@main
struct MyApp: App {
    init() {
        TpidAuth.shared.initialize(config: .init(
            clientId: "tpid_pk_your_public_key",
            redirectURI: URL(string: "com.cupol.vpn:/auth/callback")!,
            scopes: ["openid", "profile", "email"],
            theme: .auto
        ))
    }
    var body: some Scene { WindowGroup { ContentView() } }
}

struct ContentView: View {
    var body: some View {
        // Native widget — opens as a SwiftUI sheet, NOT ASWebAuthenticationSession
        TpidLoginButton { result in
            switch result {
            case .success(let session):
                print("Signed in: \(session.user.email)")
            case .cancelled:
                break
            case .failure(let err):
                print("Error: \(err.code) — \(err.localizedDescription)")
            }
        }
    }
}

let device = try await TpidAuth.shared.startDeviceFlow()
// device.userCode            → "ABCD-EFGH"
// device.verificationURIComplete → display as QR on screen
let session = try await TpidAuth.shared.pollDeviceFlow(device)

import SwiftUI
import AuthenticationServices
import TokenPayID

class AuthManager: NSObject, ObservableObject, ASWebAuthenticationPresentationContextProviding {
    let client = TPIDClient(
        clientId: "tpid_pk_your_public_key",
        redirectURI: "myapp://callback"  // public client, no secret on iOS
    )

    @Published var user: TPIDUser?
    @Published var isLoading = false
    private var session: ASWebAuthenticationSession?

    func signIn() {
        let (authURL, verifier) = client.authorizationURL(
            scopes: [.profile, .email],
            usePKCE: true
        )
        isLoading = true
        session = ASWebAuthenticationSession(
            url: authURL,
            callbackURLScheme: "myapp"
        ) { [weak self] callbackURL, error in
            guard let self, let url = callbackURL,
                  let code = url.queryParam("code") else {
                DispatchQueue.main.async { self?.isLoading = false }
                return
            }
            Task { @MainActor in
                do {
                    let tokens = try await self.client.exchangeCode(code, verifier: verifier)
                    try TPIDKeychain.save(tokens)  // secure storage
                    self.user = try await self.client.userInfo(tokens.accessToken)
                } catch { print("Auth error: \(error)") }
                self.isLoading = false
            }
        }
        session?.presentationContextProvider = self
        session?.prefersEphemeralWebBrowserSession = false  // share cookies with Safari
        session?.start()
    }

    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
        UIApplication.shared.connectedScenes
            .compactMap { ($0 as? UIWindowScene)?.windows.first }
            .first { $0.isKeyWindow } ?? ASPresentationAnchor()
    }
}

// SwiftUI View
struct ContentView: View {
    @StateObject var auth = AuthManager()
    var body: some View {
        if let user = auth.user {
            Text("Привет, \(user.name)!")
        } else {
            Button("Войти через TOKEN PAY ID") { auth.signIn() }
                .disabled(auth.isLoading)
        }
    }
}

import AppKit
import AuthenticationServices
import TokenPayID

// Добавьте в Info.plist:
// CFBundleURLTypes → CFBundleURLSchemes → "myapp"

class MacAuth: NSObject, ASWebAuthenticationPresentationContextProviding {
    let client = TPIDClient(
        clientId: "tpid_pk_your_public_key",
        redirectURI: "myapp://callback"
    )

    func authenticate() async throws -> TPIDUser {
        let (authURL, verifier) = client.authorizationURL(
            scopes: [.profile, .email], usePKCE: true
        )
        let callback: URL = try await withCheckedThrowingContinuation { cont in
            let s = ASWebAuthenticationSession(
                url: authURL, callbackURLScheme: "myapp"
            ) { url, err in
                if let url { cont.resume(returning: url) }
                else { cont.resume(throwing: err ?? TPIDError.cancelled) }
            }
            s.presentationContextProvider = self
            s.start()
        }
        guard let code = callback.queryParam("code") else { throw TPIDError.noCode }
        let tokens = try await client.exchangeCode(code, verifier: verifier)
        try TPIDKeychain.save(tokens)
        return try await client.userInfo(tokens.accessToken)
    }

    func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
        NSApp.keyWindow ?? NSApp.windows.first ?? ASPresentationAnchor()
    }
}

import Foundation
#if canImport(FoundationNetworking)
import FoundationNetworking  // Linux
#endif
import TokenPayID

let client = TPIDClient(
    clientId: ProcessInfo.processInfo.environment["TPID_CLIENT_ID"]!,
    clientSecret: ProcessInfo.processInfo.environment["TPID_CLIENT_SECRET"]!,
    redirectURI: "https://api.myapp.com/auth/callback"
)

// 1) Генерация URL авторизации — редиректим пользователя сюда
let (authURL, verifier) = client.authorizationURL(
    scopes: [.profile, .email, .openid],
    state: UUID().uuidString,
    usePKCE: true
)
// Сохраните verifier в сессии (Redis/memcached)

// 2) Callback handler — обмен кода на токены
func handleCallback(code: String, verifier: String) async throws -> TPIDUser {
    let tokens = try await client.exchangeCode(code, verifier: verifier)
    return try await client.userInfo(tokens.accessToken)
}

// 3) Vapor integration
app.get("auth", "login") { req in
    let (url, v) = client.authorizationURL(scopes: [.profile, .email], usePKCE: true)
    req.session.data["verifier"] = v
    return req.redirect(to: url.absoluteString)
}
app.get("auth", "callback") { req async throws -> Response in
    let code = try req.query.get(String.self, at: "code")
    let v = req.session.data["verifier"] ?? ""
    let user = try await handleCallback(code: code, verifier: v)
    req.session.data["user_id"] = user.id
    return req.redirect(to: "/dashboard")
}

// SDK встроенно использует Keychain через TPIDKeychain
try TPIDKeychain.save(tokens)                   // сохранить
let tokens = try TPIDKeychain.load()            // загрузить
try TPIDKeychain.clear()                        // выход

// Автоматический refresh при истечении access_token
let freshTokens = try await client.ensureFresh(tokens)

// Отзыв при logout
try await client.revoke(tokens.refreshToken)
try TPIDKeychain.clear()

// 1. Download + verify
curl -L -O https://tokenpay.space/sdk/jvm-desktop/tokenpay-id-jvm-desktop-2.6.0.tar.gz
sha256sum -c tokenpay-id-jvm-desktop-2.6.0.tar.gz.sha256
tar -xzf tokenpay-id-jvm-desktop-2.6.0.tar.gz

// 2. settings.gradle.kts
include(":tokenpay-id-jvm")
project(":tokenpay-id-jvm").projectDir = file("sdk/jvm-desktop/tokenpay-id-jvm")

// 3. app/build.gradle.kts
plugins {
    id("org.jetbrains.compose") version "1.6.10"
}
dependencies {
    implementation(project(":tokenpay-id-jvm"))
}

import androidx.compose.ui.window.*
import space.tokenpay.id.jvm.*

fun main() = application {
    TpidAuth.initialize(TpidConfig(
        clientId = "tpid_pk_your_key",
        redirectUri = "cupol-vpn://auth/callback"
    ))
    Window(onCloseRequest = ::exitApplication, title = "My App") {
        TpidLoginButton { result ->
            when (result) {
                is TpidResult.Success -> println("signed in as ${result.user.email}")
                is TpidResult.Failure -> println("error: ${result.error.code}")
                TpidResult.Cancelled -> {}
            }
        }
    }
}

// Swing
import androidx.compose.ui.awt.ComposePanel
val panel = ComposePanel()
panel.setContent { TpidLoginButton { /* ... */ } }
jframe.add(panel)

// JavaFX — wrap ComposePanel in SwingNode
val node = SwingNode()
SwingUtilities.invokeLater {
    val p = ComposePanel()
    p.setContent { TpidLoginButton { /* ... */ } }
    node.setContent(p)
}

dotnet add package TokenPayID --version 2.2.0

using TokenPayID;

var client = new TPIDClient(
    clientId: "tpid_pk_your_public_key",
    clientSecret: "tpid_sk_your_secret_key",
    redirectUri: "https://yourapp.com/callback"
);

// Генерация OAuth URL (с PKCE)
var (authUrl, verifier) = client.GetAuthorizationUrl(
    scopes: new[] { "profile", "email" },
    usePKCE: true
);

// Обмен кода на токены
var tokens = await client.ExchangeCodeAsync(code, verifier);
var user = await client.GetUserInfoAsync(tokens.AccessToken);
Console.WriteLine($"User: {user.Name} ({user.Email})");

// ASP.NET — middleware
services.AddAuthentication()
    .AddTokenPayID(options => {
        options.ClientId = "tpid_pk_...";
        options.ClientSecret = "tpid_sk_...";
    });

composer require tokenpay/id-php

use TokenPay\ID\Client;

$client = new Client([
    'client_id'     => 'tpid_pk_your_public_key',
    'client_secret' => 'tpid_sk_your_secret_key',
    'redirect_uri'  => 'https://yourapp.com/callback',
]);

// Редирект на авторизацию (с PKCE)
[$authUrl, $verifier] = $client->getAuthorizationUrl(['profile', 'email']);
$_SESSION['tpid_verifier'] = $verifier;
header("Location: $authUrl");

// Callback — обмен кода
$tokens = $client->exchangeCode($_GET['code'], $_SESSION['tpid_verifier']);
$user = $client->getUserInfo($tokens->access_token);
echo "Hello, {$user->name}!";

// Laravel — встроенный Socialite драйвер
// config/services.php
'tokenpay' => [
    'client_id' => env('TPID_CLIENT_ID'),
    'client_secret' => env('TPID_CLIENT_SECRET'),
    'redirect' => '/auth/tokenpay/callback',
]

gem 'tokenpay-id', '~> 2.2'

require 'tokenpay/id'

client = TokenPay::ID::Client.new(
  client_id: 'tpid_pk_your_public_key',
  client_secret: 'tpid_sk_your_secret_key',
  redirect_uri: 'https://yourapp.com/callback'
)

# OAuth URL
auth_url, verifier = client.authorization_url(
  scopes: ['profile', 'email'],
  pkce: true
)

# Обмен кода
tokens = client.exchange_code(params[:code], verifier)
user = client.user_info(tokens.access_token)
puts "#{user.name} (#{user.email})"

# Rails — OmniAuth стратегия
Rails.application.config.middleware.use OmniAuth::Builder do
  provider :tokenpay_id,
    ENV['TPID_CLIENT_ID'],
    ENV['TPID_CLIENT_SECRET']
end

dependencies:
  tokenpay_id: ^2.2.0

import 'package:tokenpay_id/tokenpay_id.dart';

final client = TPIDClient(
  clientId: 'tpid_pk_your_public_key',
  clientSecret: 'tpid_sk_your_secret_key',
  redirectUri: 'myapp://callback',
);

// Flutter — OAuth через url_launcher
final authUrl = client.getAuthorizationUrl(
  scopes: ['profile', 'email'],
  usePKCE: true,
);
await launchUrl(Uri.parse(authUrl));

// Обработка deep link
void handleCallback(Uri uri) async {
  final code = uri.queryParameters['code']!;
  final tokens = await client.exchangeCode(code);
  final user = await client.getUserInfo(tokens.accessToken);
  print('Hello, ${user.name}!');
}

[dependencies]
tokenpay-id = "2.2"

use tokenpay_id::Client;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new(
        "tpid_pk_your_public_key",
        "tpid_sk_your_secret_key",
    );

    // Верификация токена
    let result = client.verify(access_token).await?;
    println!("User: {}", result.user_id);

    // OAuth URL с PKCE
    let (auth_url, verifier) = client.authorization_url(
        &["profile", "email"],
        "https://yourapp.com/callback",
    )?;

    // Обмен кода
    let tokens = client.exchange_code(code, &verifier).await?;
    let user = client.user_info(&tokens.access_token).await?;
    println!("{} ({})", user.name, user.email);

    Ok(())
}

GET https://tokenpay.space/api/v1/oauth/authorize
  ?client_id=tpid_pk_...
  &redirect_uri=myapp://callback     // custom scheme
  &response_type=code
  &scope=profile email
  &state=RANDOM_STATE
  &code_challenge=BASE64URL(SHA256(verifier))
  &code_challenge_method=S256
  &theme=dark                         // dark | light — match app theme
  &lang=ru                            // ru | en | zh — UI language

const { app } = require('electron');

// Регистрация custom protocol
app.setAsDefaultProtocolClient('myapp');

// Обработка deep link (Windows/Linux)
app.on('second-instance', (event, argv) => {
  const url = argv.find(a => a.startsWith('myapp://'));
  if (url) handleOAuthCallback(url);
});

// Обработка deep link (macOS)
app.on('open-url', (event, url) => {
  event.preventDefault();
  handleOAuthCallback(url);
});

async function handleOAuthCallback(url) {
  const { searchParams } = new URL(url);
  const code = searchParams.get('code');
  const state = searchParams.get('state');
  // Обменяйте code на токены через API
}

// src-tauri/tauri.conf.json
{
  "plugins": {
    "deep-link": {
      "desktop": { "schemes": ["myapp"] },
      "mobile": [
        { "host": "callback", "pathPrefix": "/" }
      ]
    }
  }
}

// Frontend (TypeScript)
import { onOpenUrl } from '@tauri-apps/plugin-deep-link';

onOpenUrl((urls) => {
  const url = new URL(urls[0]);
  const code = url.searchParams.get('code');
  // Exchange code for tokens
});

import http.server, socketserver, threading, webbrowser, urllib.parse
import secrets, hashlib, base64, requests

CLIENT_ID = "tpid_pk_your_public_key"
REDIRECT_PORT = 53682  # порт для локального callback
REDIRECT_URI = f"http://127.0.0.1:{REDIRECT_PORT}/callback"

# PKCE
verifier = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()
challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
state = secrets.token_urlsafe(16)

# 1) Запустить локальный HTTP-сервер для callback
auth_code = {}
class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        q = urllib.parse.urlparse(self.path).query
        params = dict(urllib.parse.parse_qsl(q))
        if "code" in params:
            auth_code["code"] = params["code"]
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.end_headers()
            self.wfile.write(b"<h1>✓ Успешно!</h1><p>Можно закрыть окно.</p>")
        else:
            self.send_error(400)
    def log_message(self, *args): pass  # suppress logs

server = socketserver.TCPServer(("127.0.0.1", REDIRECT_PORT), Handler)
threading.Thread(target=server.serve_forever, daemon=True).start()

# 2) Открыть системный браузер с URL авторизации
auth_url = (
    "https://id.tokenpay.space/api/v1/oauth/authorize?"
    f"client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&response_type=code"
    f"&scope=profile+email&state={state}"
    f"&code_challenge={challenge}&code_challenge_method=S256"
)
webbrowser.open(auth_url)  # использует xdg-open на Linux

# 3) Ждать callback
while "code" not in auth_code: pass
server.shutdown()

# 4) Обменять код на токены
r = requests.post("https://id.tokenpay.space/api/v1/oauth/token", json={
    "grant_type": "authorization_code",
    "code": auth_code["code"],
    "client_id": CLIENT_ID,
    "redirect_uri": REDIRECT_URI,
    "code_verifier": verifier,
})
tokens = r.json()
user = requests.get("https://id.tokenpay.space/api/v1/oauth/userinfo",
    headers={"Authorization": f"Bearer {tokens['access_token']}"}).json()
print(f"Welcome, {user['name']}!")

# Ubuntu/Debian/Fedora/Arch — полный OAuth flow через curl + nc + xdg-open
#!/bin/bash
set -e
CLIENT_ID="tpid_pk_your_public_key"
PORT=53682
VERIFIER=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-43)
CHALLENGE=$(echo -n "$VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d "=+/")
STATE=$(openssl rand -hex 8)

# Открыть браузер
xdg-open "https://id.tokenpay.space/api/v1/oauth/authorize?client_id=${CLIENT_ID}&redirect_uri=http://127.0.0.1:${PORT}/callback&response_type=code&scope=profile+email&state=${STATE}&code_challenge=${CHALLENGE}&code_challenge_method=S256"

# Ждать callback (одноразовый HTTP-сервер через netcat)
CALLBACK=$(echo -e "HTTP/1.1 200 OK\r\n\r\n<h1>✓ OK</h1>" | nc -l -p $PORT -q 1)
CODE=$(echo "$CALLBACK" | grep -oP 'code=\K[^& ]+')

# Обменять код на токен
TOKENS=$(curl -s -X POST https://id.tokenpay.space/api/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d "{\"grant_type\":\"authorization_code\",\"code\":\"$CODE\",\"client_id\":\"$CLIENT_ID\",\"redirect_uri\":\"http://127.0.0.1:$PORT/callback\",\"code_verifier\":\"$VERIFIER\"}")
ACCESS_TOKEN=$(echo "$TOKENS" | jq -r ".access_token")

# Получить профиль
curl -s https://id.tokenpay.space/api/v1/oauth/userinfo \
  -H "Authorization: Bearer $ACCESS_TOKEN" | jq .

// Запуск браузера через gio (работает на любом Linux с GIO)
#include <gio/gio.h>
g_app_info_launch_default_for_uri(
    "https://id.tokenpay.space/api/v1/oauth/authorize?client_id=...&redirect_uri=http://127.0.0.1:53682/callback&...",
    NULL, NULL);

// Минимальный HTTP-сервер для callback — libsoup:
#include <libsoup/soup.h>
SoupServer *srv = soup_server_new("server-header", "myapp/1.0", NULL);
soup_server_add_handler(srv, "/callback", callback_handler, NULL, NULL);
soup_server_listen_local(srv, 53682, 0, NULL);

#include <QDesktopServices>
#include <QOAuth2AuthorizationCodeFlow>
#include <QOAuthHttpServerReplyHandler>

QOAuth2AuthorizationCodeFlow oauth;
oauth.setAuthorizationUrl(QUrl("https://id.tokenpay.space/api/v1/oauth/authorize"));
oauth.setAccessTokenUrl(QUrl("https://id.tokenpay.space/api/v1/oauth/token"));
oauth.setClientIdentifier("tpid_pk_your_public_key");
oauth.setScope("profile email");
oauth.setPkceMethod(QOAuth2AuthorizationCodeFlow::PkceMethod::S256);

auto *handler = new QOAuthHttpServerReplyHandler(53682);
oauth.setReplyHandler(handler);
oauth.setModifyParametersFunction([](QAbstractOAuth::Stage, QMultiMap<QString, QVariant> *p) { /* */ });

QObject::connect(&oauth, &QAbstractOAuth::authorizeWithBrowser, &QDesktopServices::openUrl);
QObject::connect(&oauth, &QOAuth2AuthorizationCodeFlow::granted, []{ qDebug() << "Authenticated!"; });
oauth.grant();

# 1. Сгенерировать PKCE verifier + challenge
verifier  = base64url(random_bytes(32))              # 43 символа
challenge = base64url(sha256(verifier))               # S256

# 2. Отправить пользователя на URL авторизации
GET https://id.tokenpay.space/api/v1/oauth/authorize?
    client_id=YOUR_PK&
    redirect_uri=YOUR_REDIRECT&
    response_type=code&
    scope=profile+email&
    state=RANDOM_STATE&
    code_challenge=CHALLENGE&
    code_challenge_method=S256

# 3. В callback — обменять code на access_token
POST https://id.tokenpay.space/api/v1/oauth/token
Content-Type: application/json

{
  "grant_type":   "authorization_code",
  "code":         "abc123...",
  "client_id":    "YOUR_PK",
  "redirect_uri": "YOUR_REDIRECT",
  "code_verifier": "VERIFIER_FROM_STEP_1"
}
→ {"access_token": "eyJ...", "refresh_token": "tpid_rt_...", ...}

# 4. Использовать access_token для API-запросов
GET https://id.tokenpay.space/api/v1/oauth/userinfo
Authorization: Bearer {access_token}
→ {"id": "tpid_usr_...", "email": "...", "name": "..."}

TpidWidget.Config {
  clientId: String             // required — ваш tpid_pk_...
  redirectUri: String          // required — должен совпадать с разрешённым в личном кабинете
  scope: List<String>         // default: ["profile", "email"]
  state: String?               // auto-generated CSRF token, verified on callback
  prompt: "login" | "consent" | "none"  // optional
  theme: "dark" | "light" | "auto"     // default: "auto" (follows system)
  lang: "ru" | "en" | "zh" | null      // null = system locale
  loginHint: String?           // pre-fill email field
  presentationStyle: "modal" | "fullscreen" | "bottomSheet"  // default: "modal"
  telemetry: Boolean           // default: true — opt-out anytime
}

TpidWidget.Result {
  success(code: String, state: String)
  error(code: TpidError, message: String, httpStatus: Int?)
}

enum TpidError {
  userCancelled,       // пользователь закрыл виджет
  networkError,        // нет сети / таймаут
  invalidClient,       // неверный client_id или redirect_uri
  invalidScope,        // scope не разрешён для клиента
  rateLimited,         // 429 — слишком частые попытки
  serverError,         // 5xx от TPID
  phishingDetected,    // сорван TLS-pin → возможная MITM-атака
  unknown
}

TpidLoginButton(
    clientId = "tpid_pk_...",
    redirectUri = "cupol://callback",
    scope = listOf("profile", "email"),
    onSuccess = { code, state -> viewModel.exchangeCode(code) },
    onError = { err -> toast(err.message) }
)

TPIDLoginButton(
    clientId: "tpid_pk_...",
    redirectURI: "cupol://callback",
    scope: [.profile, .email],
    style: .standard
) { result in
    switch result {
    case .success(let code): await exchange(code)
    case .failure(let err): show(err)
    }
}

TpidLoginButton(
  clientId: 'tpid_pk_...',
  redirectUri: 'cupol://callback',
  scope: const ['profile', 'email'],
  onSuccess: (code, state) => ref.read(auth).exchange(code),
)

await TpidLoginButton.ShowAsync(new TpidConfig {
    ClientId = "tpid_pk_...",
    RedirectUri = "myapp://callback",
    Scope = new[] { "profile", "email" },
    Theme = TpidTheme.Auto
}, onSuccess: (code, state) => ExchangeCode(code));

{
  "device_code": "tpid_dc_abc123...",
  "user_code": "ABCD-EFGH",
  "verification_uri": "https://id.tokenpay.space/device",
  "verification_uri_complete": "https://id.tokenpay.space/device?user_code=ABCD-EFGH",
  "expires_in": 600,
  "interval": 5
}

// 1. Запросить device_code
let init: DeviceInitResponse = try await api.post("/oauth/device", body: [
    "client_id": clientId, "scope": "profile email"
])
let userCode = init.user_code  // "ABCD-EFGH" — показать на экране ТВ
showOnScreen(code: userCode, url: init.verification_uri)

// 2. Polling каждые `interval` секунд
while true {
    try await Task.sleep(seconds: init.interval)
    let r: TokenOrError = try await api.post("/oauth/device/token", body: [
        "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
        "device_code": init.device_code,
        "client_id": clientId
    ])
    switch r {
    case .success(let tokens):
        saveTokens(tokens); return
    case .pending: continue          // authorization_pending
    case .slowDown: init.interval += 5; continue
    case .denied, .expired: throw TPIDError.userCancelled
    }
}

{
  "provider": "TOKEN PAY ID",
  "version": "2.5.0",
  "endpoints": {
    "authorize": "https://id.tokenpay.space/api/v1/oauth/authorize",
    "token": "https://id.tokenpay.space/api/v1/oauth/token",
    "userinfo": "https://id.tokenpay.space/api/v1/oauth/userinfo",
    "device_authorize": "https://id.tokenpay.space/api/v1/oauth/device",
    "device_token": "https://id.tokenpay.space/api/v1/oauth/device/token",
    "account_check": "https://id.tokenpay.space/api/v1/auth/account-check",
    "telemetry": "https://id.tokenpay.space/api/v1/telemetry/event",
    "openid_config": "https://id.tokenpay.space/.well-known/openid-configuration",
    "jwks": "https://id.tokenpay.space/.well-known/jwks.json"
  },
  "supported_flows": ["authorization_code", "refresh_token", "device_code", "qr_login"],
  "supported_scopes": ["openid", "profile", "email", "offline_access"],
  "supported_auth_methods": ["email_password", "email_code", "totp_2fa", "passkey", "biometric", "magic_link"],
  "supported_themes": ["dark", "light", "auto"],
  "supported_languages": ["ru", "en", "zh"],
  "presentation_styles": ["modal", "fullscreen", "bottomSheet"],
  "pkce": { "required": true, "methods": ["S256"] },
  "tls_pinning": {
    "enabled": true,
    "hosts": ["id.tokenpay.space", "tokenpay.space"],
    "pins_endpoint": "https://id.tokenpay.space/api/v1/sdk/tls-pins"
  },
  "anti_phishing_badge": { "label": "Официальный TOKEN PAY ID", "verify_url": "https://tokenpay.space/verify" },
  "rate_limits": { "auth": { "per_min": 8, "per_day": 1000 } },
  "branding": { "client_name": "CUPOL VPN", "logo_uri": "..." }
}

{
  "api": "2.5.0",
  "sdks": {
    "kotlin_android": { "version": "2.6.0", "url": "https://tokenpay.space/sdk/android/" },
    "swift": { "version": "2.6.0", "platforms": ["iOS 15+", "macOS 12+", ...] },
    "jvm_desktop": { "version": "2.6.0", "url": "https://tokenpay.space/sdk/jvm-desktop/" },
    "flutter_dart": { "version": "2.3.0", "status": "spec" },
    "dotnet": { "version": "2.3.0", "status": "spec" },
    "rust": { "version": "2.3.0", "status": "spec" }, ...
  },
  "min_supported": { "api": "2.1.0", "sdk": "2.0.0" },
  "breaking_changes": false
}

{
  "hosts": ["id.tokenpay.space", "tokenpay.space", "api.tokenpay.space"],
  "algorithm": "sha256",
  "format": "base64",
  "pins": ["PRIMARY_SPKI_B64=", "BACKUP_SPKI_B64="],
  "refresh_interval_s": 86400,
  "issued_at": "2026-04-17T13:00:00Z"
}

{
  "exists": true,
  "methods": ["email_password", "email_code", "totp_2fa", "passkey", "magic_link"],
  "can_register": false,
  "email_verified": true,
  "has_password": true,
  "has_totp": true,
  "has_passkey": true,
  "suggested_next_step": "passkey"
}

val r = api.accountCheck(email, clientId)
when (r.suggested_next_step) {
    "passkey"   -> showPasskeyScreen()          // FaceID/TouchID/Hello
    "password"  -> showPasswordScreen()         // если нет passkey
    "email_code" -> sendCodeAndShowCodeScreen() // если нет пароля
    "register"  -> showRegistrationScreen()     // exists == false
}

{
  "session_version": 7,
  "user_id": "tpid_usr_...",
  "should_reauth": false
}

// Жизненный цикл widget
widget.opened, widget.closed, widget.cancelled, widget.success

// Пошаговая воронка
widget.step_shown, widget.step_completed, widget.step_error

// Проблемы
widget.network_error, widget.rate_limited, widget.tls_pin_fail

// SDK
sdk.init, sdk.ready

// Device flow
device_flow.code_generated, device_flow.approved,
device_flow.denied, device_flow.expired

TpidTelemetry.send(
    event = "widget.step_shown",
    clientId = "tpid_pk_...",
    sessionId = widgetSession.id,
    platform = "android",
    sdkVersion = BuildConfig.SDK_VERSION,
    properties = mapOf(
        "step" to "password",
        "theme" to "dark",
        "lang" to "ru",
        "app_bundle" to "space.cupol.vpn"
    )
)

GET /api/v1/telemetry/funnel?client_id=tpid_pk_...&since=7%20days
Authorization: Bearer tpid_sk_...

→ { "events": [ { "event": "widget.opened", "count": 12403, "sessions": 9812 },
              { "event": "widget.success", "count": 7204, "sessions": 7204 } ] }