Proofs
In developmentApps already know what you've done there: your points, your tier, your standing in a community. With your consent, hApp Auth carries one of those statements to another app, which decides what it means.
Last swap: a wheel trued, 2 days ago
Welcome, Priya
From Fernway, viahApp Auth
hApp Auth carried 1,240 helper points from Fernway to Tallyhouse, because Priya chose to.
Fernway and Tallyhouse are fictional apps, each with its own badges. Priya is a synthetic person.
Step by step
Priya's helper points, from Fernway's site to Tallyhouse's. hApp Auth only appears where Priya chooses.
Fernway offers its statement. Priya keeps it in Your proofs, private.
Set your starting credit limit.
Tallyhouse names the proof it needs, why, and its own rule.
tallyhouse.app
asks for one proof, to set your starting credit limit.
Shared with tallyhouse.app.
Only this statement goes to tallyhouse.app, not the history behind it.
happauth.com/account · Your proofs
Shared with tallyhouse.app, checked monthly
Tallyhouse decides what happens to the limit; it can't keep checking.
The same pattern
Each app keeps its own look and its own meaning. Gold at Lanternhall is Lanternhall's Gold.
Gold seller at Lanternhall, shared with Brindle. Brindle decides whether the hold returns.
Latest order: a brass desk lamp
Darius's lamps
From Lanternhall, viahApp Auth
hApp Auth carried Gold seller from Lanternhall to Brindle, because Darius chose to.
Recognized member at Commonroot, shared with Kestrel Commons. Removing it doesn't remove Aled: a membrane decides who joins, not who stays.
Next: the spring seed swap
Aled joined
From Commonroot, viahApp Auth
hApp Auth carried Recognized member from Commonroot to Kestrel Commons, because Aled chose to.
What hApp Auth does, and doesn't
A badge belongs to the app that gave it. hApp Auth shows a proof as a plain line: the statement and who made it.
Nothing is added up into a number about you. No leaderboard, no “verified human”.
Nothing is shared until you say so, to that app, for that purpose.
The app is told. What it already received, it keeps; we say so.
The receiving app sets its own rule. A proof grants nothing by itself.
No one can buy a proof, a tier or a place. hApp Auth has no price.
What's real
Passkey, GitHub or an email code. A private ID per site, a choice for each field you share, and Disconnect or deletion that tells every site.
hAppRadar checks that you maintain a project. You choose to share that with QuickhApp to open the project's website. Try it here.
What a hApp could issue once issuing opens, as in Priya's, Darius's and Aled's examples. Not shipped.
Interactive example · fictional project
asks for a maintainer proof
Purpose: open this project's website.
Project maintainer · SolarisChecked by hAppRadarChoose whether to include this proof. This example shares nothing.
For hApp builders
If your hApp knows something useful about a person, let them carry it, in your own design. If your hApp needs evidence, ask for it with a purpose and keep your own rule.
// A sketch of the shape we're designing. Not an API yet.
const url = client.buildAuthorizationUrl(config, {
redirect_uri: callbackUrl,
scope: "openid",
claims: JSON.stringify({
id_token: {
"https://fernway.app/proofs/helper_points": {
purpose: "Set your starting credit limit",
},
},
}),
});
// Shared by the person, the ID token carries that one statement:
// "https://fernway.app/proofs/helper_points":
// { "value": 1240, "issuer": "fernway.app", "checked_at": 1760950000 }
A sketch on OpenID Connect's standard claims request, to show the shape. No endpoint accepts it yet.
Standard OpenID Connect in ten lines. Proofs are designed to arrive on the same connection.
State what your app stands behind: points, a tier, a role. Your badge, your design, your definition; you can withdraw it.
Ask for one named proof and say why. You receive that statement, its issuer and when it was checked, never the history behind it.
Which issuers you trust, and what a proof lets someone do in your hApp, is your call.