Docs · Overview
hApp Auth docs
hApp Auth is a standard OpenID provider for the Holochain web, plus the two things no standard provider does: it binds a person’s agent keys to their account, and it signs short facts a DNA verifies offline.
Three jobs
| Job | Who it serves | What they get |
|---|---|---|
| Sign-in | Any website: hAppRadar, QuickhApp, a maker’s site, a forum | “Sign in with hApp Auth” through any OpenID Connect library, with no registration form and no secret |
| Key binding Coming | A person who uses hApps on several devices | One account that knows which agent keys are theirs; a network can learn two keys are the same person |
| Attestations Coming | A maker whose hApp wants an admission rule | A membrane proof the integrity zome checks with one signature verification, no server at validation time |
hApp Auth proves facts; the network’s operator holds the policy. A maker never registers a network with us. hApp Auth issues a claim to anyone it is true of, bound to the DNA and the key that asked.
Where to start
QuickstartAdd sign-in to a website in ten lines with openid-client.OpenID ConnectThe protocol, the scopes, the claims and the assurance levels.PasskeysHow people sign in, recover, and how you check how they did.Agent sign-inComingSign a person in from inside a hApp with their agent key.Multi-device identityComingOne person, several devices, one pairwise id per network.Membrane proofsComingAdmission rules your DNA checks offline, and their limits.
What we never do
- We never hold, generate, back up or escrow an agent key or seed.
- We never claim what Holochain cannot enforce. The membrane proofs page says so where a maker would assume otherwise.
- We never link accounts implicitly. Linking needs the person signed in to both sides at once.
- No model call on any hApp Auth endpoint. Sign-in is deterministic, always.
- No tracking. We record that a person signed in to a site so they can see and revoke it; third-party sites get pairwise identifiers.
- Nothing of ours signs bytes the caller chooses. Every signature is over a domain-prefixed message we construct.
Free, and no plan
hApp Auth is free and holds no plan, price or customer status. Payment buys nothing, and there is no payment.