Sign people in to your app (authorization code + PKCE)

Register a redirect URI on your app (project → app → redirect URIs). It must match exactly. https is required; http://localhost, 127.0.0.1 and [::1] are allowed for sandbox apps only. To try the flow before your own callback exists, register https://openvibe.codes/oauth/test-callback: it shows what Network sent and never uses it.
Make a PKCE pair. A random code_verifier (43–128 characters) and code_challenge = BASE64URL(SHA-256(code_verifier)). Network requires code_challenge_method=S256 for every app, public or confidential. The SDK does it: createPkcePair(), startAuthorization() in openvibe-sdk/auth.
Send the browser to https://openvibe.network/oauth/authorize with response_type=code, client_id (your app id), redirect_uri, state, the challenge, and optionally scope (capability ids, which limit what the code can yield). prompt=none is refused for apps: a person always chooses to continue. A sandbox app can be authorized only by members of its project.
Network redirects back with code and your state (or error). Check the state. Codes are single use and expire after 5 minutes; a failed PKCE check burns the code.
Exchange on your server: POST https://openvibe.network/oauth/token with grant_type=authorization_code, client_id, code, redirect_uri, code_verifier, audience (the service you will call, e.g. openvibe.media) and, for a confidential app, client_secret. The token lasts 5 minutes and carries on_behalf_of (the person) and cap (your approved grants for that audience). Apps get no refresh token.

Sign people in to your app (authorization code + PKCE)

Build a test authorization URL