Directory publishing
List a Stoat bot
Use this when you want server owners to discover, review, and add a bot that you already operate on Stoat.
Open Add Bot Community identity for Stoat
Add Stoat login to your app with Continue with StoatBoard
Add a consent-based, community-verified Stoat identity to Web apps and SPAs without building and operating your own bot.
Independent community service — not official Stoat OAuth and not affiliated with Stoat.
Why this exists
A Stoat sign-in option without handling user session tokens
Stoat's public authentication guide currently documents bot tokens and user session tokens. Continue with StoatBoard adds a separate, consent-driven identity layer for third-party apps that need login, not a credential for controlling a Stoat account.
- No Stoat bot to build for your own application
- No Stoat user token requested or shared
- Explicit consent for profile, email, and linked Stoat identity
Choose the right tool
Bot listings and application sign-in are two different workflows
“Add Bot” publishes a bot in the StoatBoard directory. It does not create credentials for signing users into your website or SPA.
Identity integration
Add sign-in to your application
Use this when your website or SPA needs to authenticate a StoatBoard user and, with consent, receive their verified linked Stoat identity.
From account to working client
- 1
Link your Stoat identity once
Sign in to StoatBoard and complete the bot-backed proof. Returning users normally skip this step.
- 2
Create an application and client
Choose a confidential Web client or public SPA client, then register every callback URL exactly.
- 3
Integrate standard OpenID Connect
Discover the issuer, use Authorization Code with PKCE S256, and render a Continue with StoatBoard button.
Standards-based OIDC
Authorization Code, mandatory PKCE S256, discovery, JWKS, UserInfo and revocation.
Bot-backed identity proof
StoatBoard verifies which Stoat account sent the command without ever asking for a user session token.
Web and SPA clients
Confidential Web backends receive rotatable secrets; public SPAs use PKCE without a secret.
Developer FAQ
Before you integrate
Is Continue with StoatBoard official Stoat OAuth?
No. It is an independent StoatBoard service and is not operated, endorsed, or certified by Stoat.
Do I need to build my own Stoat bot?
No. StoatBoard's companion bot performs the account-control proof. Your application integrates the published OpenID Connect flow.
Can its tokens call the Stoat API?
No. StoatBoard tokens identify and authorize a user only inside your StoatBoard integration. They never expose or replace a Stoat session token.
Which user data can my application receive?
The openid scope returns an opaque StoatBoard subject. Profile, verified email, and linked Stoat identity are separate consented scopes.
Privacy boundary
Your application gets only what the user approves
The required openid scope returns an opaque StoatBoard subject. Profile, verified email and Stoat identity are separate permissions. Users can revoke access at any time, and unlinking Stoat revokes every downstream authorization immediately.