NOVA Developer Arena

Build on Nova

Two free developer surfaces: the Temp Mail API for throwing disposable inboxes at your test suite, and Sign in with Nova — a privacy-first OAuth-style sign-in so your users never need a new password.

Sign in with Nova

Let your users authorize with their Nova Mail account. Nova never shares their password or messages — the app only receives a scoped token, an email, and a display name. Owner-approved, so the ecosystem stays spam-free.

The button

Animated, hover-reactive, free to embed. See the component on the docs page.

POST /api/oauth/apps with your app name, redirect URI(s), and email. Captcha-protected, owner-gated.

Redirect

Send users to /oauth/authorize with client_id, redirect_uri, state, scope=email.

Consent

Nova shows a consent screen. The user approves and Nova returns an authorization code to your URI.

Exchange

Server-side, swap code + client_secret for an access token, then read /userinfo.

Node sample

// Flow: (1) redirect the browser
window.location = `https://nova-email.com/oauth/authorize` +
  `?client_id=${CLIENT_ID}` +
  `&redirect_uri=${encodeURIComponent(REDIRECT)}` +
  `&state=${crypto.randomUUID()}` +
  `&scope=email`;

// (2) the user lands back on your redirect_uri with ?code=&state=
// (3) exchange the code (server side, never expose client_secret)
const res = await fetch("https://nova-email.com/api/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    grant_type: "authorization_code",
    code,
    client_id: CLIENT_ID,
    client_secret: CLIENT_SECRET,
  }),
});
const { access_token, email, display_name } = await res.json();

// (4) fetch the profile
const me = await fetch("https://nova-email.com/api/oauth/userinfo", {
  headers: { Authorization: `Bearer ${access_token}` },
});

Endpoints

POST

/api/oauth/apps

GET

/api/oauth/apps?client_id=…

Public app info for your consent screen.

POST

/api/oauth/authorize

Issue an authorization code for a signed-in user.

POST

/api/oauth/token

Exchange code+secret for an access token (server-side).

GET

/api/oauth/userinfo

Get the signed-in user's profile with the access token.

Keep client_secret server-side only, always validate state, and use HTTPS redirect URIs.