Integração com o IDCamim

const express = require('express');
  const axios   = require('axios');
  const crypto  = require('crypto');
  const session = require('express-session');

  const app = express();
  app.use(session({ secret: 'sua-secret-key', resave: false, saveUninitialized: false }));

  const CLIENT_ID     = 'camim_SEU_CLIENT_ID';
  const CLIENT_SECRET = 'SEU_CLIENT_SECRET';
  const REDIRECT_URI  = 'https://seusistema.com.br/auth/callback';
  const CAMIM_BASE    = 'https://auth.camim.com.br';

  app.get('/login', (req, res) => {
    const state = crypto.randomBytes(16).toString('hex');
    req.session.oauthState = state;
    const params = new URLSearchParams({
      client_id: CLIENT_ID, redirect_uri: REDIRECT_URI,
      response_type: 'code', scope: 'openid profile email', state,
    });
    res.redirect(`${CAMIM_BASE}/auth?${params}`);
  });

  app.get('/auth/callback', async (req, res) => {
    if (req.query.error) return res.status(400).send(req.query.error_description);
    if (req.query.state !== req.session.oauthState) return res.status(400).send('State inválido');
    delete req.session.oauthState;

    const { data: tokens } = await axios.post(`${CAMIM_BASE}/token`,
      new URLSearchParams({ grant_type: 'authorization_code',
        code: req.query.code, redirect_uri: REDIRECT_URI }),
      { auth: { username: CLIENT_ID, password: CLIENT_SECRET } }
    );
    const { data: user } = await axios.get(`${CAMIM_BASE}/me`,
      { headers: { Authorization: `Bearer ${tokens.access_token}` } }
    );
    req.session.user = { id: user.sub, email: user.email, name: user.name };
    res.redirect('/dashboard');
  });

<?php // login.php
  session_start();
  $state = bin2hex(random_bytes(16));
  $_SESSION['oauth_state'] = $state;
  header('Location: https://auth.camim.com.br/auth?' . http_build_query([
      'client_id' => 'camim_SEU_CLIENT_ID',
      'redirect_uri' => 'https://seusistema.com.br/callback.php',
      'response_type' => 'code', 'scope' => 'openid profile email', 'state' => $state,
  ]));

  // callback.php
  if ($_GET['state'] !== $_SESSION['oauth_state']) die('State inválido');
  $ch = curl_init('https://auth.camim.com.br/token');
  curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true,
      CURLOPT_USERPWD => 'camim_SEU_CLIENT_ID:SEU_CLIENT_SECRET',
      CURLOPT_POSTFIELDS => http_build_query(['grant_type' => 'authorization_code',
          'code' => $_GET['code'], 'redirect_uri' => 'https://seusistema.com.br/callback.php']),
  ]);
  $tokens = json_decode(curl_exec($ch), true);
  $ch = curl_init('https://auth.camim.com.br/me');
  curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true,
      CURLOPT_HTTPHEADER => ["Authorization: Bearer {$tokens['access_token']}"],
  ]);
  $user = json_decode(curl_exec($ch), true);
  $_SESSION['user'] = ['id' => $user['sub'], 'email' => $user['email']];

# pip install authlib
  # settings.py
  IDCAMIM = {
      "CLIENT_ID":     "camim_SEU_CLIENT_ID",
      "CLIENT_SECRET": "SEU_CLIENT_SECRET",
      "REDIRECT_URI":  "https://seusistema.com.br/auth/callback",
      "DISCOVERY_URL": "https://auth.camim.com.br/.well-known/openid-configuration",
      "SCOPES":        "openid profile email",
  }

  # views.py
  import secrets
  from django.conf import settings
  from django.shortcuts import redirect
  from authlib.integrations.requests_client import OAuth2Session

  def camim_login(request):
      conf = settings.IDCAMIM
      state = secrets.token_urlsafe(16)
      request.session["oauth_state"] = state
      client = OAuth2Session(conf["CLIENT_ID"], redirect_uri=conf["REDIRECT_URI"], scope=conf["SCOPES"])
      meta = client.get(conf["DISCOVERY_URL"]).json()
      url, _ = client.create_authorization_url(meta["authorization_endpoint"], state=state)
      return redirect(url)

  def camim_callback(request):
      conf = settings.IDCAMIM
      client = OAuth2Session(conf["CLIENT_ID"], redirect_uri=conf["REDIRECT_URI"])
      meta = client.get(conf["DISCOVERY_URL"]).json()
      tokens = client.fetch_token(meta["token_endpoint"], code=request.GET["code"],
                                  client_secret=conf["CLIENT_SECRET"])
      user = client.get(meta["userinfo_endpoint"]).json()
      request.session["user"] = {"id": user["sub"], "email": user["email"], "name": user.get("name")}
      return redirect("/dashboard/")

// pages/api/auth/[...nextauth].js
  import NextAuth from "next-auth";

  export default NextAuth({
    providers: [{
      id: "idcamim", name: "Camim", type: "oauth",
      wellKnown: "https://auth.camim.com.br/.well-known/openid-configuration",
      clientId: process.env.IDCAMIM_CLIENT_ID,
      clientSecret: process.env.IDCAMIM_CLIENT_SECRET,
      authorization: { params: { scope: "openid profile email" } },
      idToken: true, checks: ["state"],
      profile(profile) {
        return { id: profile.sub, name: profile.name, email: profile.email };
      },
    }],
  });

  // .env.local
  // IDCAMIM_CLIENT_ID=camim_SEU_CLIENT_ID
  // IDCAMIM_CLIENT_SECRET=SEU_CLIENT_SECRET
  // NEXTAUTH_SECRET=outra-chave-aleatoria
  // NEXTAUTH_URL=https://seusistema.com.br