If you are building a website and need to sign people in, you can use IndieLogin.com to handle all the complicated parts.
Users will identify themselves with their website, and can authenticate using one of the supported authentication providers such as Twitter, GitHub, GitLab, Codeberg, or email. The user ID returned to you will be their website, ensuring that you don't end up creating multiple accounts depending on how the user authenticates.
Every application that signs people in with IndieLogin.com needs its client_id registered here first. A sign-in request from an unregistered client_id is rejected.
Your client_id is the URL of your application, the same way a Client ID Metadata Document describes it. Your redirect_uri then has to be on that same domain.
To register one, sign in with your own website. You will need a website set up for web sign-in, and an email address so we have a way to contact you about your applications.
<form action="https://indielogin.com/authorize" method="get">
<label for="url">Web Address:</label>
<input id="url" type="text" name="me" placeholder="yourdomain.com" />
<p><button type="submit">Sign In</button></p>
<input type="hidden" name="client_id" value="https://example.com/" />
<input type="hidden" name="redirect_uri" value="https://example.com/redirect" />
<input type="hidden" name="state" value="3629184e7337edb24cf4972a" />
<input type="hidden" name="code_challenge" value="lvJhhmzjEHMqkqFFDqx4OH5JUGejBJm33zu5t6peCEA" />
<input type="hidden" name="code_challenge_method" value="S256" />
</form>Note: You can also generate these parameters server-side and send them as an HTTP redirect instead of building a form.
action: Set the action of the form to this service (https://indielogin.com/authorize) or download the source and run your own server.me: (optional) The me parameter is the URL that the user enters. If you leave this out, then this website will prompt the user to enter their URL.client_id: Set the client_id in a hidden field to let this site know the home page of the application the user is signing in to.redirect_uri: Set the redirect_uri in a hidden field to let this site know where to redirect back to after authentication is complete. It must be on the same domain as the client_id.state: You should generate a random value that you will check after the user is redirected back, in order to prevent certain attacks.code_challenge: Generate a random string between 43-128 characters, then generate a SHA256 hash and base64-url encode that to create the code_challenge. You can use example-app.com/pkce to test your work.code_challenge_method=S256: Set to S256 to indicate the hash method used.prompt=login: (optional) If this parameter is present in the request, this website will not remember the user's previous session and will require that they authenticate from scratch again.After the user enters their domain in the sign-in form and submits, IndieLogin.com will scan their website looking for rel="me" links from providers it knows about (see Supported Providers).
They will authenticate using one of the supported providers, such as authenticating with their own IndieAuth server, logging in on GitHub, or verifying a temporary code sent to their email address.
https://example.com/redirect?state=3629184e7337edb24cf4972a&code=8378f2a929fce312edf8dd9d00df74e901db1325c14f31e13d9df168f780c155&iss=https%3A%2F%2Findielogin.com%2F
If everything is successful, the user will be redirected back to the redirect_uri you specified in the form. You'll see three parameters in the query string, state, iss, and code. Check that the state matches the value you set originally, and check that iss matches https://indielogin.com/ in order to confirm the redirect is coming from the legitimate website.
At this point you need to exchange the authorization code which will return the website of the authenticated user. Make a POST request to https://indielogin.com/token with the code, client_id, redirect_uri, and code_verifier, and you will get back the full website of the authenticated user.
POST https://indielogin.com/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: application/json code=8378f2a929fce312edf8dd9d00df74e901db1325c14f31e13d9df168f780c155& redirect_uri=https://example.com/redirect& client_id=https://example.com/& code_verifier=afb6e6601eb05dad7d0daf1da8fc359ff984625d48981002ec01525b
An example successful response:
HTTP/1.1 200 OK
Content-Type: application/json
{
"me": "https://aaronparecki.com/"
}
An example error response:
HTTP/1.1 400 Bad Request
Content-Type: application/json
{
"error": "invalid_request",
"error_description": "The code provided was not valid"
}
At this point you know the website belonging to the authenticated user.
You can store the website in a secure session and log the user in as their website identity. You don't need to worry about whether they authenticated with Twitter, Github, GitLab, Codeberg, or email address, their identity is their website! You won't have to worry about merging duplicate accounts or managing OAuth credentials at these platforms.
IndieLogin.com is provided as a free service, as-is and with no warranty of any kind. There is no uptime guarantee, no service level agreement, and no support commitment. The service may be slow, unavailable, or changed or discontinued at any time, with or without notice.
If your application depends on being able to sign people in, you are strongly encouraged to run your own copy of the software. It is open source, and you can point the action of your sign-in form at your own installation instead. Running your own copy means you control the uptime, the logs, and the set of providers you support, and your users aren't depending on a service you don't operate.
Registered client_ids and developer accounts may be removed if an application is abusive, is used to send unsolicited email, or otherwise causes problems for this service or for the authentication providers it relies on.
Use of this service is also subject to the Privacy Policy.