Sign in with your website

Let people sign in to your site using their own domain, with no passwords for you to store. Their website's IndieAuth server confirms who they are, and this service tells your site the answer.

Register your site

Add it to your site

Create a random state and PKCE code_verifier in your site's session, then send the person here:

https://login.lifeofpablo.com/authorize
  ?client_id=https://example.com/
  &redirect_uri=https://example.com/callback
  &state=RANDOM
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256

They come back to your redirect_uri with code, state and iss. Check that state matches and that iss is https://login.lifeofpablo.com/, then confirm the code from your server within 60 seconds:

POST https://login.lifeofpablo.com/token
Content-Type: application/x-www-form-urlencoded
Accept: application/json

code=CODE&client_id=https://example.com/
&redirect_uri=https://example.com/callback
&code_verifier=VERIFIER

The answer is the verified website: {"me": "https://person.example/"}

Options

• me: the website to sign in, if you already know it. Anyone else is refused.
• scope=profile: also ask for their name and photo, if their server shares them.

Your redirect_uri must be on the same origin as your client_id. Standard IndieAuth clients can also use this service: its metadata is at /.well-known/oauth-authorization-server.