Skip to main content
Veriqa plugs into a CMS as an ordinary OpenID Connect provider, and CMS engines connect with no changes on the Veriqa side. Everything needed lives on the integrator’s side — from a six-line file on WordPress to a socialservices provider on Bitrix.

​
What was verified

Two independent clients — Drupal and WordPress — verified the Veriqa id_token signature against JWKS and accepted it.

​
The client must be confidential

A requirement common to all five engines: register the client with a secret. Veriqa lets such a client work without PKCE, and that is what makes off-the-shelf plugins workable. A public client without PKCE is refused, and plain is accepted from nobody.

​
Email — where one engine’s recipe stops transferring to another

Telegram does not hand out an email and never will, and the engines disagree on what to do about that. “A CMS requires an email at registration” holds only for Bitrix, and only by default. WordPress and TYPO3 do not require an email, while Drupal and Joomla require one on every sign-in, not just at registration: Where the address is mandatory and the channel provides none, a synthetic address of the form {channel}-{id}@{channel}.veriqa.invalid is used. The .invalid domain is reserved by RFC 2606 and is never delivered to — an account holding one gets no notifications and no password recovery. That is a decision for the integrator (ask for the address in a second step, use the Email channel), not a complete solution.

​
Limitations

  • channels other than Telegram: WordPress, Drupal, Joomla and TYPO3 were verified on Telegram only. “CMS + Email” was verified end to end on Bitrix only; WhatsApp and the other channels were not tested with any CMS;
  • a public deployment with a real domain and a valid certificate was not tested. It removes the local obstacles (a self-signed CA, a private issuer) — see Local testing.
Systems that are not CMS engines — GitLab, Keycloak, Grafana, Nextcloud — have a page of their own: Veriqa in business systems. SaaS site builders (Shopify, Wix) connect through the platform’s own SSO settings: see SaaS builders.