Developers

Sign in with 1code ID

OpenID Connect · issuer https://auth.1code.id · updated 18 October 2026

1code ID is a standard OpenID Connect issuer. Your site or app redirects to it; the person approves the sign-in with their fingerprint or Face ID in the 1code ID app on their phone; you get back an ID token you verify against our JWKS. No passwords, nothing to store.

Endpoints

All on https://auth.1code.id. Read them from discovery rather than hard-coding them.

What verified_human means

Ask for the verified_human scope and the ID token carries verified_human: true when the person approved with their fingerprint or Face ID, on a phone enrolled in their 1code ID, at that moment. That is the whole meaning, and it does not change: it is not a liveness or identity-document check, and a later hardware or attestation tier upgrades device_kind, never what verified_human means. The companion claims: verification_method is biometric_mobile_oob (approved out of band on the phone), verified_at says when, and device_kind is unknown unless the phone's key was attested by its platform.

Redirect URI rules

• Absolute https:// URLs only, no #fragment, no whitespace. Registered URIs must match byte for byte.
• The one exception: loopback for local development — http://localhost:<port>/… or http://127.0.0.1:<port>/…. Any other http:// host is refused.
• Register every URI you will use (production and local) up front.

Getting a client

Registration is not self-service yet. Email support@1code.id with your app's name, its redirect URIs, whether it is a confidential server-side app or a public mobile / single-page app, and the scopes you need. You receive a client_id and, for confidential clients, a client_secret.

Minimal authorization-code example

1. Send the browser to authorize (PKCE shown; always use it):

https://auth.1code.id/api/sso/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fcallback
  &scope=openid%20email%20verified_human
  &state=RANDOM_STATE
  &nonce=RANDOM_NONCE
  &code_challenge=BASE64URL(SHA256(code_verifier))
  &code_challenge_method=S256

The person scans the QR shown there with the 1code ID app and approves with their fingerprint or Face ID. You get ?code=…&state=… back at your redirect URI.

2. Exchange the code (server-side for confidential clients):

POST https://auth.1code.id/api/sso/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=THE_CODE
&redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fcallback
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET   (omit for public clients)
&code_verifier=THE_CODE_VERIFIER

3. Verify the id_token: signature against /api/sso/jwks (ES256), iss = https://auth.1code.id, aud = your client_id, exp, and that nonce matches what you sent. Then read sub (stable per person), email, email_verified and verified_human. Sign out by clearing your own session; revoke the refresh token at /api/sso/revoke if you kept one.

The button

Use the official mark as an asset — never redraw it. Black button, white lockup:

Sign in with 1code ID

<a class="signin" href="https://auth.1code.id/api/sso/authorize?…">
  <img src="https://1code.id/brand/1code-logo-white.png" alt="" height="16">
  Sign in with 1code ID
</a>

Good to know

• Sign-in needs the 1code ID app on the person's phone (coming to the App Store and Google Play). Accounts are created on the web, not in the app.
• Same signing key on auth.1code.id and the older za.vaulk.id name; new integrations use auth.1code.id only.
• Questions: support@1code.id.