Groupe KA
One account, seven platforms: the KA ID is the identity backbone of the entire Ka family.
The Groupe KA holding hub, live at www.groupe-ka.com, serves as showcase site, account manager, and home-grown SSO server for all seven Ka platforms.
7
Platforms served by SSO
17
API routes
8
Pages
~5,400
Lines of TypeScript/TSX
7
Production dependencies
3
Sign-in methods
Overview
Groupe KA is the showcase site of the Ka holding and the home of the KA ID, a unique member identifier (ka- plus 10 digits) created at the hub and used as the group's source of truth. Members sign in three ways: Google OAuth 2.0, Sign in with Apple, or email and password hashed with Node's native scrypt. Each account carries an enriched profile (bio, city, social links, role) with a public page at /u/[kaId], plus a membership card with a QR code and a signed Apple Wallet pass.
The hub doubles as a home-grown SSO server for seven platforms: Lou·Ka, Immo·Ka, Vrai-Prix, ValoPlex, Auto·Ka, Fabri·Ka, and Food·Ka. A call to /sso/authorize?client=<platform> issues a 5-minute JWT signed with that platform's shared secret, while /api/sso/profile and /api/sso/favorites let every platform read the member profile and push into the unified "Mon univers Ka" favorites store. Sessions are HS256 JWTs (jose) kept in an HttpOnly ka_session cookie for 30 days; Google id_tokens are verified against JWKS and Apple's client_secret is an ES256 JWT signed on the fly.
The whole hub fits in roughly 5,400 lines of TypeScript/TSX plus an ~850-line hand-rolled CSS design system, exposing 8 pages and 17 API routes on only 7 production dependencies. The stack is Next.js 16 (App Router, Turbopack), React 19, TypeScript 5, Tailwind CSS 4, better-sqlite3 in WAL mode (zero database server), jose for JWT/JWKS, sharp for avatars, and qrcode for the member card. In production it runs on MacLustr cluster node M3U96b under PM2 with an ngrok tunnel to www.groupe-ka.com.
Key Features
KA ID
A unique member identifier (ka- plus 10 digits) minted at the hub and used as the single source of truth across the whole Ka group.
Three sign-in modes
Google OAuth 2.0 with JWKS-verified id_tokens, Sign in with Apple via form_post, or email and password hashed with native Node scrypt and constant-time comparison.
Home-grown SSO
/sso/authorize issues a 5-minute JWT signed with a per-platform shared secret, logging members into all seven Ka platforms from one account.
Enriched public profiles
Bio, city, social links, and role displayed by every platform, with a public profile page at /u/[kaId] for each member.
Apple Wallet member card
A membership card with QR code plus a cryptographically signed Apple Wallet pass generated at /api/wallet/pass.
Unified favorites
The "Mon univers Ka" central favorites store: platforms push and read member favorites through the /api/sso/favorites endpoint.
How It Works
Sign-in
The member authenticates via Google OAuth 2.0 (id_token verified against Google's JWKS), Sign in with Apple (ES256 client_secret signed on the fly from the .p8 key), or email plus scrypt-hashed password.
KA ID creation
The hub mints a unique ka- + 10-digit identifier and stores the account in a zero-server SQLite database running in WAL mode, linked by google_sub, apple_sub, or email.
Session
An HS256 JWT signed with jose is set as an HttpOnly ka_session cookie valid for 30 days, backing the /compte account pages and profile APIs.
SSO handoff
A platform redirects to /sso/authorize?client=<platform>; the hub issues a 5-minute JWT signed with that platform's dedicated shared secret and sends the member back authenticated.
Cross-platform sync
Platforms read the enriched profile and push unified favorites through /api/sso/profile and /api/sso/favorites, while /api/wallet/pass serves the signed Apple Wallet membership card.
Tech Stack
Frontend
Auth & Data
Deployment
Highlights
- The KA ID (ka- plus 10 digits) created at the hub is the single source of truth for identity across seven Ka platforms.
- Only 7 production dependencies: passwords use native Node crypto.scryptSync with constant-time comparison, no auth library.
- SSO tokens are short-lived 5-minute JWTs, each signed with a dedicated per-platform shared secret.
- Apple sign-in generates its ES256 client_secret JWT on the fly from the .p8 private key.
- Members get a QR-coded card and a signed Apple Wallet pass served from /api/wallet/pass.
- The mobile menu is 100% CSS (checkbox plus peer selector) with zero JavaScript shipped for it.
Explore Groupe KA
One KA ID across seven Ka platforms — the full source is on GitHub.