Login, consent, payments, employee identity, check-in and physical access. Every call resolves to a real, verified human being — not a session, not a token you issued yourself.
Requires a verified personal account and an approved
SafeQloud Business
account. Both, before any credentials.
// 1 — send them to SafeQloud. They scan and consent.
GET /walk/authorize.php?response_type=code
&client_id=${clientId}&state=xyz&signin=1
// 2 — exchange the code
POST /walk/token.php
{ grant_type, code, client_id, client_secret }
// 3 — a person comes back
{ "type": "signin",
"first_name": "Alex",
"email": "alex@...",
"country_of_residence": "SE",
"user": 1 }
Access
Every developer on SafeQloud is a verified individual attached to a verified business. An identity layer that anyone could join would not be worth building on.
Your own SQ ID. The same account any individual has.
Documents checked against the issuing authority. Required before anything corporate.
You must be an owner or an employee of the business you register.
Approved per business. Credentials are then generated per API, per application.
The APIs
Each needs its own client credentials, generated per application. You do not apply six times.
walk/authorize.php
Your user clicks sign in, is redirected to SafeQloud, scans with their app, consents, and comes back verified. OAuth2 authorization code flow, with a two-way handshake that kills replay attacks.
GET /walk/authorize.php
?response_type=code
&client_id=YOUR_CLIENT_ID
&state=xyz&signin=1
POST /walk/resource_signin.php?signin=1
{ "type": "signin",
"first_name": "Alex",
"email": "alex@...",
"country_of_residence": "SE",
"user": 1 }walk/resource_signin.php
The user is shown your terms, scans, and signs. Logged, time-stamped, tied to a verified identity, and revocable by them at any time from their app.
GET /walk/authorize.php
?response_type=code
&client_id=YOUR_CLIENT_ID
&state=xyz&signin=1
# after the scan
{ "type": "signin",
"first_name": "Alex",
"seller_company_id": 1,
"user": 1 }LoginAccount/loginPurchaseVerify
Your checkout sends the amount. The user scans, confirms what they are paying, and authorises it against their identity. Two-way handshake, transaction id returned.
GET /LoginAccount/loginPurchaseVerify
?client_id=YOUR_CLIENT_ID
&purchase=1&total=89.00
{ "user": "0", // 0 personal, 1 company
"company": "0",
"customer_id": "cu_***",
"transaction_id": "tran_***" }Curl/addEmployee
Issue, update and revoke Work IDs programmatically. Encrypted before transmission. The employee receives it in their app, and it revokes itself on the exit date you set.
const payload = encrypt({
company_email: "company@example.com",
fname: "Alex", lname: "Johnson",
wemail: "alex@company.com",
enumber: "EMP-001", d_country: "SE"
})
POST /Curl/addEmployee/{encrypted}
POST /Curl/relieveEmployee/{encrypted}QloudidApp/verifyInterAppSession
Your app wakes SafeQloud on the device. The person confirms, a session token comes back, you verify it with us and receive the confirmed identity. iOS and Android.
# wake the app
Android https://safeqloud.com
iOS com.Qloudid.Url
POST /QloudidApp/verifyInterAppSession
{ session: session_from_app }
{ "user_id": 1, "result": 1 }v1/identity/access/verify
QR at any access point — a door, a server room, a folder. Scanned against the role on the Work ID. Granted or denied on the spot, and every event logged with identity, time and place.
POST /v1/identity/access/verify
{
"qr_token": "sqt_live_abc123...",
"access_point": "door_server_room_b2",
"company_id": "YOUR_COMPANY_ID"
}
{ "granted": true,
"user_id": "usr_7f3a9b...",
"role": "engineering",
"logged_at": "2026-04-11T14:32:00Z" }The pattern
The same three steps every time. What changes is the endpoint and what comes back.
At the moment it matters — a sign-in button, a checkout, a door terminal, a document.
GET authorize.php?client_id=…The app opens, shows what is being asked, and they approve it against their own identity.
scanned → approved → code issuedExchange the code for a token, then re-verify with us. The handshake is what stops a replay.
POST token.php → resource.phpGet access
Approval is per business. Once you are through, you generate client credentials for each API and each application from your dashboard.
Sandbox included. SDKs for Node, Python, PHP and Ruby;
iOS and Android for
check-in.