Sign in
Beta

DevelopersAdd Noir ID to a website.

Noir ID uses standard OpenID Connect. Your website sends people to the hosted sign-in and gets a subject back. During the beta we register each client ourselves.

Request early access

The model
in six lines

Standard
OpenID Connect
Flow
Authorization code with PKCE (S256)
Sign-in
Hosted by Noir ID, passkey first
Subject
Pairwise, one per client
Callbacks
Exact URLs, no wildcards
Permissions
Stay in your product

Which pattern
your app uses

  • Web app with a server

    Your server runs the code flow and keeps the tokens. The browser only holds a secure session cookie that means nothing on its own.

  • Mobile or desktop app

    Open the sign-in in the system browser, never in an embedded web view, and receive the result on your registered callback.

  • Service to service

    Machine clients use the client credentials grant, with short-lived tokens of their own.

Four steps
to a working sign-in

  1. Register your client

    Send us your app’s name and its exact callback URLs. You receive a client ID, and a secret if your app has a server.

  2. Send people to sign in

    Redirect to the authorization endpoint with your client ID, callback, scope, a random state and a PKCE challenge.

  3. Handle the callback

    Check the state, exchange the code with the PKCE verifier, and validate the ID token: signature, issuer, audience and expiry.

  4. Keep the subject

    Key your user record on the subject Noir ID returns. It stays the same for your client and means nothing anywhere else.

What the request looks like

Values in angle brackets are yours. The issuer is https://id.noir.bzh: read the endpoints from its discovery document instead of hard-coding them.

GET <authorization_endpoint>
  ?response_type=code
  &client_id=<your client id>
  &redirect_uri=https://app.example/callback
  &scope=openid
  &state=<random value>
  &code_challenge=<base64url(sha256(verifier))>
  &code_challenge_method=S256

What Noir ID will not do

  • Password or implicit grants
  • Wildcard or partial-match callback URLs
  • Sign-in embedded in your page or an iframe
  • Open client registration without review
  • Decide what a user may do in your product

Before you go live

  • Every callback URL is registered exactly as it is used
  • State and PKCE are checked on every sign-in
  • ID tokens are validated, not just decoded
  • A failed sign-in is handled as a failed sign-in, not as an outage
  • You know how you would move your users if you left

Want to integrateearly?

Tell us what you are building and which pattern it uses. Early integrations help shape the first release.

Request early access