Login with ACLC

1. Overview

1. Redirect the user to our Authorize URL.
2. They sign in on ACLC and approve sharing data with your app.
3. We redirect back to your redirect_uri with a one-time code.
4. Your server exchanges the code for an access_token (keep client_secret on the server only).
5. Call Userinfo with the access token to get the user profile fields you were granted.

2. Credentials

ACLC issues your application credentials. Contact the portal administrator.

• client_id — public identifier
• client_secret — private; never expose in browsers or mobile apps
• redirect_uris — exact callback URLs registered for your app (must match character-for-character)
• allowed origins / domains / IPs — if set, token and userinfo calls are rejected unless Origin/Referer or client IP matches
• rate limit — per-key throttle configured by ACLC (default 60 requests/minute)

Authorization codes expire in 10 minutes. Access tokens expire in 60 minutes.

3. Authorize (browser redirect)

GET https://aclctaytay.online/oauth/authorize

Success redirect:

https://your-app.example/callback?code=AUTH_CODE&state=YOUR_STATE

Denied:

https://your-app.example/callback?error=access_denied&state=YOUR_STATE

4. Token exchange (server-side)

POST https://aclctaytay.online/oauth/token · application/x-www-form-urlencoded or form fields

Success response:

{
  "access_token": "…",
  "token_type": "Bearer",
  "expires_in": 3600
}

Errors may return invalid_client (401) or invalid_grant (400).

5. Userinfo

GET https://aclctaytay.online/oauth/userinfo

Authorization: Bearer ACCESS_TOKEN

You may also POST with the same header, or send access_token as a form/query field.

Minimal response (always included):

{
  "name": "Juan Dela Cruz",
  "usn_key": "a1b2c3…hmac-sha256-hex"
}

usn_key is a stable HMAC of the user’s USN. It is not reversible by your app. Use it as your external user id. Raw USN is only returned if ACLC granted that claim to your client.

6. Optional claims

Granted per client by ACLC admin. If not granted, the field is omitted.

Example with all optional claims granted:

{
  "name": "Juan Dela Cruz",
  "usn_key": "a1b2c3…",
  "usn": "2024-00123",
  "email": "juan@example.com",
  "course": "BSIT"
}

7. Minimal PHP example

// 1) Send user to authorize
$authorize = 'https://aclctaytay.online/oauth/authorize?' . http_build_query([
    'response_type' => 'code',
    'client_id'     => $clientId,
    'redirect_uri'  => $redirectUri,
    'state'         => $state,
]);
header('Location: ' . $authorize);

// 2) On callback: exchange code (server-side)
$ch = curl_init('https://aclctaytay.online/oauth/token');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'grant_type'    => 'authorization_code',
        'code'          => $_GET['code'],
        'redirect_uri'  => $redirectUri,
        'client_id'     => $clientId,
        'client_secret' => $clientSecret,
    ]),
]);
$token = json_decode(curl_exec($ch), true);

// 3) Fetch profile
$ch = curl_init('https://aclctaytay.online/oauth/userinfo');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $token['access_token'],
    ],
]);
$profile = json_decode(curl_exec($ch), true);
// $profile['name'], $profile['usn_key'], …

8. Attendance student lookup

Server-to-server only. Requires the Attendance lookup capability plus at least one origin, domain, or IP lock on the client.

POST https://aclctaytay.online/oauth/attendance/student

Browser/kiosk callers must send a matching Origin header. Server callers with no Origin must use an allowed IP/CIDR.

Success response (PII is limited to attendance fields):

{
  "usn": "26000377500",
  "first_name": "Tristan",
  "last_name": "Baracena",
  "middle_name": "",
  "name": "Tristan Baracena",
  "course": "BS in Information Systems",
  "year_level": "1st Year",
  "section": "A",
  "photo_available": true,
  "photo_url": "https://aclctaytay.online/oauth/attendance/student/photo?token=…"
}

photo_url is a short-lived signed link (about 60 seconds) and still requires the same origin/IP lock. Email, mobile, address, and guardian fields are never returned.

curl -X POST "https://aclctaytay.online/oauth/attendance/student" \
  -H "Origin: https://attendance.example.com" \
  -d "client_id=…" \
  -d "client_secret=…" \
  -d "usn=26000377500"