# Sign in with OSINTverse

Let people sign in to your app with their OSINTverse account. Standard OpenID Connect with PKCE, identity only.

URL: https://osintverse.com/docs/oauth

Sign in with OSINTverse is an OpenID Connect provider. Add it to your app the same way you would add any other OIDC login: point your library at the discovery document, register a redirect URI, and request `openid profile email`.

Your app learns who the person is (a stable `sub`, their name, and their email). It never sees their searches, cases, wallet, or API keys, and it cannot spend credits. For data access, use the [API](https://osintverse.com/docs/api/overview) with the person's own key or connect an agent over [MCP](https://osintverse.com/docs/mcp).

## How it works

1. Create an app on [Dashboard → Developer](https://osintverse.com/dashboard/developer). Choose **Web app with a server** (gets a client secret), **Single-page app** (public, PKCE), or **CLI, desktop, or device** (public, PKCE or the [device flow](https://osintverse.com/docs/oauth/device-flow)).
2. Configure your OIDC library with the client ID and the issuer `https://osintverse.com/api/auth`. Everything else comes from discovery:

```
https://osintverse.com/api/auth/.well-known/openid-configuration
```

3. Sign in yourself, and add up to ten testers by email. Only you and your testers can sign in while the app is in testing.
4. [Submit it for review](https://osintverse.com/docs/oauth/review). Once approved, anyone with an OSINTverse account can sign in.

## What people see

People sign in on osintverse.com the way they normally do, then see a consent screen with your app's name, logo, homepage, and the details it will receive. Approved apps carry a **Reviewed by OSINTverse** badge; apps in testing say so. People can sign out of your app at any time from **Settings → Connected apps**, which deletes every token your app holds for them.

## Endpoints

All endpoints are listed in discovery. Do not hardcode them.

| What             | Value                                                              |
| ---------------- | ------------------------------------------------------------------ |
| Issuer           | `https://osintverse.com/api/auth`                                  |
| Discovery        | `https://osintverse.com/api/auth/.well-known/openid-configuration` |
| JWKS             | `https://osintverse.com/api/auth/jwks`                             |
| ID token signing | `EdDSA` (Ed25519). Make sure your library supports it.             |
| PKCE             | Required for every client (`S256`)                                 |