Testing and common problems
Trying it from your laptop, problems that come up often, and a checklist before going live.
Trying it from your laptop
You don't need to run a sign-in server yourself. Testing apps may use localhost URLs, so the app on your laptop can talk to https://accounts.society-ai.org directly.
- Ask for a testing app with the callback URL exactly as you use it on your laptop, for example
http://127.0.0.1:8000/auth/callback, and put your email on the tester list. - Fill in
.envon your laptop with the testing app's Client ID and secret. - Run your app and click sign in. The Society AI sign-in page says "Sign in to continue to your app name".
- Sign in with a tester account. The sign-in code goes to the tester's email as usual.
localhost and 127.0.0.1 count as different addresses. Register the one you actually open in the browser.
Back-channel logout can't reach your laptop, because the Society AI server can't call your localhost. Try that part on a staging server with an https://…society-ai.org address.
Common problems
| What you see | Most likely cause | Fix |
|---|---|---|
"Sign-in is unavailable right now", with redirect_uri in the page address | The callback URL is one character off: trailing slash, http or https, port, localhost or 127.0.0.1 | Match the registered URL exactly |
| "This app is still in testing" | A testing app, and the email used isn't on the tester list | Ask an admin to add the email, or use the production app |
error=invalid_scope on the callback | Asking for a scope that wasn't approved | Match the scopes in .env to what the admin approved |
invalid_grant on the code swap | The callback ran twice, the code is over 10 minutes old, or the code_verifier is from another attempt | Keep a verifier per sign-in attempt, and don't reload the callback page |
invalid_client | Wrong secret, mixed up with the testing app, or already replaced | Check .env on the running server |
| Public pages keep redirecting | The automatic sign-in flag isn't saved before redirecting | See Automatic sign-in and sign-out |
| The member signed out on society-ai.org but is still signed in to your service | Back-channel logout missing, blocked by CSRF (419), or sid not stored | Check the back-channel route's logs. Make sure it is excluded from CSRF. |
| Signing out ends on "Sign-in is unavailable right now" | The id_token_hint isn't an ID token from your app, or it got damaged | Send the latest ID token your app received |
No membership claims | The membership scope wasn't requested | Add it to the scopes |
| Every sign-in creates a new user | sai_sub isn't saved, for example because of $fillable | Use forceFill like the Laravel example |
Still stuck? Email support@society-ai.org with your Client ID, when it happened, and the error_description. Never include a secret or a token.
Checklist before going live
- Using the production app, not the testing one
- Every URL is
https://on asociety-ai.orgsubdomain - The secret lives only on the server, not in a repo or browser code
- PKCE
S256andstatechecked on every sign-in - ID tokens checked: signature,
iss,aud,exp - Members recognised by
sub - Back-channel logout tried on staging
- The sign-out button goes to
/oauth2/sessions/logout - Public pages still open for guests
- Sign-in button and account menu follow step 9 of the Laravel guide