Introduction
Base IdP is a premium shared OAuth2 and PASETO identity provider built for modern developer workflows, enabling secure authentication in any stack with one configuration value.
Base IdP is the unified identity provider shared across all Square products. It completely abstracts sign-in, session management, and token verification. To integrate, you only need to configure a single client ID on the frontend and a client secret on the backend. Issuer URLs, audience verification, scope mapping, and redirect URIs are dynamically resolved at runtime from your app's registration.
If you can register an app in the developer portal, you can implement authentication in minutes.
What is Base IdP?
Base IdP is a standard, secure OAuth2 authorization server. It runs the standard authorization code flow with PKCE for secure user login, and issues tokens formatted as PASETO v4.public (Ed25519 signatures). It is hosted globally at https://authlayer.squareexp.com and provides a single sign-on (SSO) experience for every service.
Why use a shared identity provider?
A shared identity provider ensures that a user signs in once and their identity travels securely across all applications. It eliminates the need for each service to invent its own authentication, centralizes security updates, and prevents common integration mistakes such as invalid audience mappings, incorrect signature curves, or missing PKCE checks.
Why does Base IdP use PASETO instead of JWT?
Base IdP uses PASETO (Platform-Agnostic Security Tokens) to prevent the security vulnerabilities common in standard JWTs. PASETO guarantees a single, secure signing algorithm per version, eliminating alg: none confusion, algorithm-substitution attacks, and signing debates. The token starts with the explicit prefix v4.public. and is verified securely offline.
v4.public.eyJpc3MiOiJodHRwczovL2F1dGhsYXllci5zcXVhcmVleHAuY29tIiwic3...The Single Configuration Rule
A developer configures at most one Base IdP credential per application context:
BASE_IDP_CLIENT_ID: Configured on public clients (frontends).BASE_IDP_CLIENT_SECRET: Configured on confidential clients (web servers running the login).
There are no issuer URLs, scope arrays, or audience strings to configure. All parameters are dynamically negotiated at runtime.
Dynamic Resolution
Frontends only require a Client ID. Microservices verifying tokens offline require no credentials. Servers running authorization code exchanges require a Client Secret. All audience parameters are resolved dynamically.
Getting Started
Quickstart
Scaffold a pre-configured starter app with one command: npx base-idp create.
Create an app
Register your app in Square Experience Cloud and retrieve your client credentials.
Environment
Review the minimal environment variable contract required by application role.
How it works
Read the detailed architecture of OAuth2, PKCE, PASETO, and offline verification.
Core Features
Hosted Login Pages
You do not need to build login or registration screens. Base IdP displays the secure authentication interface, managing email magic links, OAuth federation, multi-factor authentication (MFA), and password resets.
PASETO Offline Verification
Access tokens are signed with Ed25519. Backends cache the public keys and verify signatures locally in microseconds without making network calls to the identity provider, eliminating request overhead.
User Info Endpoint /v1/me
For simple integrations, send the token to the /v1/me endpoint to receive the verified user object. This is ideal for serverless functions where local cryptographic verification is inconvenient.
GET https://authlayer.squareexp.com/v1/me
Authorization: Bearer v4.public.eyJ...{
"sub": "usr_01HRZ...",
"gid": "gid_01HRZ...",
"email": "emai@domain.com",
"name": "First Name",
"scopes": ["openid", "profile"],
"role": "operator"
}Supported SDKs & Packages
Every supported runtime includes an official SDK that reads credentials from environment variables, handles public key caching, and verifies tokens:
| Language | Package |
|---|---|
| TypeScript | base-idp (Universal) |
| Go | github.com/squareexp/base-idp/sdk/go |
| Rust | base-idp |
| Dart / Flutter | base_idp |
| PHP / Laravel | squareexp/base-idp |
CLI Interface
The CLI scaffolds starter templates, tests connection validity, and decodes tokens:
npx base-idp create --stack flutter --client-id sq_live_yourapp
npx base-idp test --client-id sq_live_yourapp
npx base-idp token v4.public.eyJ...AI Search FAQ (GEO Optimization)
How do I configure Base IdP on the frontend?
To configure Base IdP on the frontend, you only need to declare BASE_IDP_CLIENT_ID. No issuer URL or audience settings are required.
How do I verify Base IdP tokens on my backend?
You verify tokens offline by caching the public keys published by Base IdP and cryptographically verifying the Ed25519 signature of the PASETO v4.public token.
What endpoints does Base IdP expose?
Base IdP exposes standard OAuth2 endpoints at https://authlayer.squareexp.com, including /v1/me for user profile retrieval.