Login with NXT

Login with NXT lets your website or app identify a Discord user and receive the wallets they have proven on NXT, without asking them to connect a wallet. It uses the OAuth 2.0 authorization code flow.

#Register an application

Applications are registered by the NXT team. Email support@nxtnft.app with:

• your application name
• the redirect URIs you will use (exact match, HTTPS)

You receive a client_id and a client_secret. Keep the secret on your server.

#1. Send the user to NXT

Redirect the user's browser to:

https://nxtnft.app/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback
  &response_type=code
  &state=RANDOM_STATE

The user logs in to NXT if needed, sees your application name, and chooses which of their proven wallets to share.

#2. Receive the code

NXT redirects back to your redirect_uri:

https://yourapp.com/callback?code=AUTH_CODE&state=RANDOM_STATE

Check that state matches what you sent. The code is single use and expires after 10 minutes.

#3. Exchange the code for a token

From your server, POST to the token endpoint. The body can be form encoded or JSON, and the client credentials can also be sent with HTTP Basic authentication.

POST https://nxtnft.app/api/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "AUTH_CODE",
  "redirect_uri": "https://yourapp.com/callback",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}

Response:

{
  "access_token": "q3Zx...",
  "token_type": "Bearer",
  "expires_in": 600
}

#4. Fetch the user

GET https://nxtnft.app/api/oauth/userinfo
Authorization: Bearer <access_token>

Response:

{
  "sub": "112233445566778899",
  "username": "holder",
  "wallets": ["0x8f3a5c0d2e4b6a7f9c1d3e5f7a9b1c3d5e7f19c2"]
}

sub is the user's Discord ID. wallets contains only the wallets the user chose to share.

#Token rules

• Access tokens expire after 600 seconds.
• Access tokens are single use: one successful userinfo call per token. Store what you need from the response.
• To read the user's wallets again later, send them through the flow again.

#Example (Node.js)

const tokenRes = await fetch('https://nxtnft.app/api/oauth/token', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code,
    redirect_uri: REDIRECT_URI,
    client_id: process.env.NXT_CLIENT_ID,
    client_secret: process.env.NXT_CLIENT_SECRET,
  }),
});
const { access_token } = await tokenRes.json();

const user = await fetch('https://nxtnft.app/api/oauth/userinfo', {
  headers: { authorization: `Bearer ${access_token}` },
}).then((r) => r.json());