Examples
Vite SPA (PKCE)
A public OAuth client using Authorization Code + PKCE — no secret, for browser, mobile, and CLI apps.
A pure browser app using the Authorization Code + PKCE flow — the right pattern for SPAs, mobile, and CLIs where you can't safely keep a secret. It signs the user in, then calls the API with their access token.
Because there's no secret, the only sensitive step is proving possession of the PKCE verifier at the token endpoint — so this pattern is safe to ship entirely in the browser bundle.
Deploy it
Or scaffold it locally:
npm create @model-match -- --template vite-spa-pkceWhat you'll need
A public OAuth client registered with Model Match, and its redirect URI set
to your deployed callback (https://your-app/oauth/callback). See
Authentication.
Environment variables
| Variable | Required | Notes |
|---|---|---|
VITE_MODEL_MATCH_CLIENT_ID | yes | Your public OAuth client ID (no secret). |
VITE_MODEL_MATCH_ISSUER | no | Defaults to https://auth.modelmatch.com/api/auth. |
VITE_MMR_API_URL | no | Defaults to https://api.modelmatch.com. |
VITE_MODEL_MATCH_REDIRECT_URI | yes | Must match a redirect URI on your OAuth client. |
Run it locally
npm create @model-match -- --template vite-spa-pkce
cd vite-spa-pkce
npm install
npm run devOpen localhost:5173 and sign in.