integrate-identity-providerslisted

# Integrate identity providers Adding external **login** (Google/Apple/Facebook) and **identity verification / KYC** (e.g. Singpass) to a backend, the right way: as an **OIDC relying party** that delegates auth to the provider and **verifies the result cryptographically**. Examples name real public providers; the flow is a standard so it ports to any language. principle → **▸ Example** → **▸ Other stacks**. The *frontend* login UI + session (NextAuth, route guards) is `secure-a-frontend-app`; exposing *your own* API to partners is `integrate-external-services` §5. This skill is the backend/server + verification side. ## Core principle **Never roll your own identity or trust a client-supplied identity blob.** Delegate authentication to an OIDC provider, **verify the returned token's signature + claims** yourself, then map the external identity to your own user. For a KYC provider (Singpass), the returned attributes are **authoritative** — store them as verified, don't let the user edit them. ## 1. The relying-party flow (authorization code + PKCE) - **Redirect the user to the provider's `authorize` endpoint** with `state` (CSRF) + `nonce` (replay) + **PKCE** `code_challenge`; keep `state`/`code_verifier` server-side (or in a signed cookie). On the **callback**, check `state`, then **exchange the `code`** at the `token` endpoint for an `id_token` + `access_token`. Confidential clients authenticate the exchange with a **client secret or a signed `client_assertion` JWT