Overview
Costia keeps track of a person’s spending. Your shop already knows exactly what it sold: which products, at what price, with which taxes. This API exists so that data travels intact from where it is created to where it is needed, instead of going through a photo of a receipt and a model that interprets it.
There are two things you can do, and they are independent.
Sign in with Costia
Section titled “Sign in with Costia”Your customer signs into your shop with their Costia account, the same way they would with Google. You get their identifier, plus their name and email if they grant them. It is standard OpenID Connect: if your framework speaks OIDC, it already knows how.
Send invoices to their account
Section titled “Send invoices to their account”When someone buys, you send the invoice to their Costia account with its lines, amounts and VAT rates. It shows up as an itemised expense, without your customer doing anything.
What you need
Section titled “What you need”Register a partner and create an OAuth client, both from the developer console. There is no form for anyone to approve by hand and no email to wait for.
To sign in, that is all. To write invoices you must also prove you control your brand’s domain, by publishing a TXT record or a file on your site. The reason is that your shop’s name appears in the person’s expense as a verified merchant, and that word has to mean something: without the check, anyone could register as “Amazon” and write invoices in its name.
Before you write any code
Section titled “Before you write any code”Two things that save you an afternoon, because they fail in ways that do not point at the cause:
PKCE is mandatory. Costia registers every client requiring it. An authorization
request without a code_challenge is rejected during validation — before the login
screen and before consent — and your user comes back to your site without seeing any
error. Many libraries ship with it turned off.
A confidential client authenticates with Basic. The secret goes in the
Authorization header, not in the body. Sending it in the body fails as invalid_client
after consent. A native app must be registered as a public client: it has no secret and
exchanges the code using its client_id and code_verifier.
The short version
Section titled “The short version”https://id.costia.app/.well-known/openid-configurationThat document holds the authorization, token and key endpoints. Point your library at it and you will not have to copy a single URL by hand.