If you choose to authenticate with Twitter, IndieLogin.com uses the Twitter API to verify your account. The least amount of permissions this site can request from the Twitter API is to read your tweets. This site does not actually read your tweets or access your Twitter account in any way other than to verify your Twitter username after you authenticate. Your Twitter tokens are never stored by this site or provided to the site you're logging in to.
If you are uncomfortable with the permissions requested, you can choose to authenticate using a different provider such as your IndieAuth server, GitHub, email, or PGP key.
If you choose to authenticate with GitHub, IndieLogin.com uses the GitHub API to verify your account. The least amount of permissions this site can request from GitHub is accessing your public data. This site does not actually access your GitHub account other than to verify your username. Your GitHub token is never stored by this site or provided to the site you're logging in to.
If you are uncomfortable with the permissions requested, you can choose to authenticate using a different provider such as your IndieAuth server, Twitter, email, or PGP key.
IndieLogin.com is a service for developers who want to offload logging in users to an external service, and implements web sign-in by consuming IndieAuth, other OAuth APIs, as well as email and PGP verification.
IndieAuth is a protocol that lets your website be its own identity while supporting OAuth 2.0.
If you'd like to let people log in to your website or application, you can implement web sign-in yourself, or you can delegate that to IndieLogin.com.
If you'd like to add IndieAuth support to your website, visit indieweb.org/IndieAuth for links to services, plugins, and other documentation you can use to get started.
Absolutely yes! In fact, if you're developing an application, you're absolutely encouraged to implement web sign-in yourself, or run a copy of this code on your own. You can find the source code to IndieLogin.com on GitHub.