모바일 앱 SSAFY 인증 공식 연동 범위

official_support:
  - Verify API protocol
  - SSAFY Verify hosted verification page
  - /verify/token backend exchange contract
  - verification_token claim contract

best_effort_reference:
  - platform deep link examples
  - system browser launch examples

unsupported:
  - embedded WebView authorization
  - persistent or long-term storage of code, token, code_verifier, or client_secret in the app
  - mobile app direct /verify/token exchange with client_secret

allowed_short_lived_transaction_state:
  - state in app memory or short-lived encrypted transaction storage
  - code_verifier in the same transaction state until callback/backend exchange
  - discard state and code_verifier immediately after backend exchange or timeout

create mobile verify transaction:
  state:
    generate: cryptographically secure random string, 32+ chars
    store: app memory or short-lived encrypted transaction state only
    never_store: persistent storage, analytics, crash logs, or long-term cache
    ttl: 5 minutes or less
    compare: callback state must exactly equal stored state

  code_verifier:
    generate: PKCE allowed chars, 43-128 chars
    store: same short-lived transaction state as state
    never_store: persistent storage, analytics, crash logs, or long-term cache
    send_to_backend: only after callback state matches
    discard: after backend exchange finishes

  code_challenge:
    method: S256
    value: base64url(sha256(code_verifier)) without padding

GET https://verify.myknow.xyz/verify/authorize

required query:
  client_id=client_example_public
  redirect_uri=https://partner.example.com/mobile/ssafy/callback
  scope=ssafy.verify ssafy.affiliation ssafy.name
  state=random_state_from_app
  code_challenge=pkce_s256_challenge
  code_challenge_method=S256

success callback:
  redirect_uri?code=code_from_ssafy_verify&state=random_state_from_app&iss=https%3A%2F%2Fverify.myknow.xyz

failure callback:
  redirect_uri?error=access_denied&error_code=CONSENT_DENIED&request_id=req_placeholder&state=random_state_from_app

iOS Universal Link:
  redirect_uri: https://partner.example.com/ios/ssafy/callback
  associated_domains: applinks:partner.example.com
  association_file: https://partner.example.com/.well-known/apple-app-site-association

Android verified App Link:
  redirect_uri: https://partner.example.com/android/ssafy/callback
  intent_filter: scheme=https, host=partner.example.com, pathPrefix=/android/ssafy/callback
  association_file: https://partner.example.com/.well-known/assetlinks.json

Fallback custom scheme:
  redirect_uri: partnerapp://ssafy/callback
  use_only_when: Universal Link or App Link cannot be used
  review: collision risk and exact redirect URI registration

{
  "applinks": {
    "apps": [],
    "details": [
      {
        "appIDs": [
          "TEAMID.com.example.partner"
        ],
        "components": [
          {
            "/": "/ios/ssafy/callback"
          }
        ]
      }
    ]
  }
}

[
  {
    "relation": [
      "delegate_permission/common.handle_all_urls"
    ],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example.partner",
      "sha256_cert_fingerprints": [
        "SHA256_CERT_FINGERPRINT_PLACEHOLDER"
      ]
    }
  }
]

{
  "mobileApp": {
    "sendsToOwnBackend": {
      "code": "code_from_callback",
      "codeVerifier": "pkce_verifier_from_app_memory",
      "redirectUri": "https://partner.example.com/mobile/ssafy/callback",
      "iss": "https://verify.myknow.xyz"
    }
  },
  "backend": {
    "exchangesWithSsafyVerify": {
      "endpoint": "https://verify.myknow.xyz/verify/token",
      "contentType": "application/x-www-form-urlencoded",
      "grant_type": "verification_code",
      "client_id": "client_example_public",
      "code": "code_from_callback",
      "code_verifier": "pkce_verifier_from_app_memory"
    }
  }
}

{
  "code": "code_from_callback",
  "codeVerifier": "pkce_verifier_from_client",
  "redirectUri": "https://partner.example.com/ssafy",
  "iss": "https://verify.myknow.xyz"
}

{
  "ok": true,
  "verified": true,
  "sub": "pairwise_subject_placeholder",
  "cohort": "15",
  "campus": "서울 캠퍼스",
  "authTime": 1781740800
}