EventID
Book a demo

Developers

Standard OpenID Connect, with event context on top

EventID is a standard OpenID Connect provider. Use the library you already trust, then call one endpoint to learn which company, event and permissions apply to your app.

Request a test client
  1. 01

    Register your app

    During the pilot, our team registers your redirect URIs and gives you a client ID (and a secret for server-side apps). Self-service registration comes later.

    # Discovery document
GET https://<issuer>/.well-known/openid-configuration
  2. 02

    Sign people in

    Authorization code flow with PKCE (S256). Request openid email profileplus the EventID scopes you need. Tokens are asymmetrically signed; refresh tokens keep long sessions alive.

    import * as client from "openid-client";

const config = await client.discovery(
  new URL(process.env.EVENTID_ISSUER),
  process.env.EVENTID_CLIENT_ID,
  process.env.EVENTID_CLIENT_SECRET,
);

const url = client.buildAuthorizationUrl(config, {
  redirect_uri,
  scope: "openid email profile eventid:entitlements.read",
  code_challenge,
  code_challenge_method: "S256",
});
  3. 03

    Ask what applies to your app

    With the access token, call GET /v1/me/entitlements. You get the person's companies, the events they take part in, their stands and the permissions the organiser granted your app. The subject is pairwise: unique to your app.

    {
  "subject": "rp_7f3k…",
  "organisations": [{
    "id": "org_01J…",
    "legal_name": "Acme Displays Pty Ltd",
    "role": "admin",
    "events": [{
      "id": "evt_01J…",
      "name": "Melbourne Build Expo 2027",
      "participation": "exhibitor",
      "stands": ["C12"],
      "permissions": ["supplier:order", "supplier:view_invoices"]
    }]
  }]
}
  4. 04

    Stay in sync

    Subscribe to webhooks such as membership.revoked so access ends in your system the moment a company removes someone. Payloads carry IDs only; call back for detail.

    // membership.revoked
{
  "organisation_id": "org_01J…",
  "person_id": "per_01J…",
  "role": "member",
  "revoked_at": "2027-03-02T09:14:00Z"
}

Scopes

Ask only for what you need

A scope is necessary but never sufficient: the organiser's grant and the person's consent decide what you see.

ScopeGives you
openid email profileVerified email and name in the ID token
eventid:me.readThe person's profile via /v1/me
eventid:entitlements.readCompanies, events, stands and permissions for your app
eventid:org.readCompany details and, with a grant, its members
eventid:events.readEvents your app has been granted
eventid:registrations.linkLink a visitor's ticket to their identity (event apps)

Building for exhibitors or visitors?

Tell us about your platform and we'll set you up with a test client and sample code.

Book a demoSee features