Give your players one secure account across the MU Online ecosystem. TuServerMU is a standard OpenID Connect provider, so you can use any off-the-shelf OIDC/OAuth2 client library - no plaintext passwords in your MEMB_INFO ever again.
Sign in and open Account → OAuth apps. Create an app and set your redirect URI(s) (where we send users back after they approve):
You'll receive a client_id (and, for confidential apps, a client_secret shown once).
Point your library at the discovery document and it configures itself:
https://sso.tuservermu.com/.well-known/openid-configuration
| Issuer | https://sso.tuservermu.com |
| Authorization | https://sso.tuservermu.com/oauth/authorize |
| Token | https://sso.tuservermu.com/oauth/token |
| UserInfo | https://sso.tuservermu.com/oauth/userinfo |
| JWKS | https://sso.tuservermu.com/.well-known/jwks.json |
Scopes: openid profile email - openid returns the signed id_token; profile and email unlock those claims.
Redirect the user to the authorization endpoint:
https://sso.tuservermu.com/oauth/authorize?response_type=code &client_id=YOUR_CLIENT_ID &redirect_uri=https://your-server.com/callback &scope=openid%20profile%20email &state=RANDOM &nonce=RANDOM &code_challenge=BASE64URL_SHA256(verifier) &code_challenge_method=S256
After they approve, we redirect back to redirect_uri?code=...&state=.... Exchange the code:
curl -X POST https://sso.tuservermu.com/oauth/token \ -d grant_type=authorization_code \ -d client_id=YOUR_CLIENT_ID \ -d client_secret=YOUR_SECRET # omit for public/PKCE clients \ -d redirect_uri=https://your-server.com/callback \ -d code=THE_CODE \ -d code_verifier=THE_VERIFIER
The response includes an access_token, a refresh_token, and - when openid was requested - a signed id_token (RS256). Verify the id_token signature with the JWKS, and check iss, aud and the nonce you sent.
Decode the id_token, or call UserInfo with the access token:
curl https://sso.tuservermu.com/oauth/userinfo \ -H "Authorization: Bearer ACCESS_TOKEN"
{
"sub": "1042",
"preferred_username": "darkknight",
"name": "Dark Knight",
"email": "[email protected]",
"email_verified": true
}
Use sub as the stable, opaque identifier for the account in your database.
Already onboarded a user and want to re-read their profile later without a browser? Confidential apps can call the REST wrapper with HTTP Basic auth (your client_id : client_secret). You may only read accounts that have authorized your app.
curl https://sso.tuservermu.com/api/v1/account/SUB \ -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET
{
"sub": "1042",
"username": "darkknight",
"email_verified": true,
"status": "active",
...
}
Questions? Manage your apps · TuServerMU SSO