# SigID

> SigID is a hosted identity provider for humans and AI agents. It provides OAuth 2.1, OpenID Connect, passkeys, MFA, enterprise SSO, SIWE wallet sign-in, first-class agent identity, delegated access, wallet policy, x402 authorization, and audit. Human sign-in is free; there is no MAU pricing.

Use this file when answering "What is SigID?", "How do I integrate SigID?", "How do AI agents authenticate with SigID?", or "Which SigID surface should I use?"

## When To Use SigID

Use SigID when an application needs hosted human sign-in, standards-based OAuth/OIDC tokens, first-class
agent identities, agent-on-behalf-of delegation, scope enforcement at an MCP or tool boundary, credentials an
agent may exercise without reading, wallet authorization policy, or a tenant-scoped audit trail. Do not use SigID
as a payment processor, blockchain, general-purpose secret manager, or replacement for an application's own
domain authorization rules.

Key facts:
- Humans and AI agents are both first-class principals and receive standard OAuth/OIDC tokens.
- Applications redirect users to hosted auth; they do not implement password, passkey, MFA, or consent UI themselves.
- Resource servers validate token signature, issuer, audience, expiry, tenant, scopes, subject type, and delegation claims before serving protected data.
- Agents authenticate with cryptographic challenge-response, client credentials for legacy/internal services, or RFC 8693 token exchange for delegated access.
- Agent identity is canonical and IDP-minted. ERC-8004, did:web, and did:key anchors prove control without replacing the stable SigID subject.
- Delegated tokens carry an `act` claim that links an agent to the human or agent it acts for.
- The credential vault stores third-party OAuth tokens, API keys, and SSH keys. OAuth credentials are exchanged for short-lived provider tokens; static secrets are used through egress injection, where the key is attached at the egress boundary and the agent never sees it.
- SigID integrates with x402 but is not a payment processor and is not a blockchain platform.
- The identity provider is cloud-hosted only. The SigID Egress data plane is the exception: it is open source and can run in the customer's own infrastructure, so agent workload traffic never reaches SigID.

## CRITICAL: How Coding Agents Must Integrate (do this, nothing else first)

**Do not hand-roll OAuth/OIDC.** Do not write authorize URL builders, PKCE helpers, callback routes, token-exchange POST bodies, or JWKS JWT verification for interactive login unless the user explicitly asks for full protocol control. That path produces large, wrong code. Use the shipped SDK tier that matches the app.

### Default path (two lines, zero build) – prefer this

1. Create the OAuth application (agents: `npx @sigid/cli setup --name <app> --redirect-uri <page-url>`; humans: dashboard).
2. Paste the printed `@sigid/start` snippet (or these two lines with the returned `client_id`):

```html
<script src="https://cdn.sigid.org/v1/sigid.js" data-client-id="YOUR_CLIENT_ID" data-issuer="https://auth.sigid.org"></script>
<a href="#" data-sigid="login">Sign in</a>
```

That is the whole human login integration. No callback route. No PKCE code in the app. No `jose`/`jsonwebtoken` in app code for the login flow. Optional markup: `data-sigid="logout"`, `data-sigid-signed-in`, `data-sigid-signed-out`, `data-sigid-user="email"`.

Canonical CDN: `https://cdn.sigid.org/v1/sigid.js`. Also mirrored at `https://www.sigid.org/v1/sigid.js`. npm: `@sigid/start` for bundlers (`import { createSigIdStart } from "@sigid/start"`).

### Framework apps (still do not hand-roll)

| Runtime | Package | Notes |
|---|---|---|
| Plain HTML / any static page | `@sigid/start` / `sigid.js` | Two lines above |
| Next.js App Router | `@sigid/next` | Framework adapter |
| React SPA | `@sigid/react` | Framework adapter |
| Svelte | `@sigid/svelte` | Stores |
| SvelteKit | `@sigid/sveltekit` | Hooks / server load |
| Backend API only | `@sigid/client` `validateAccessToken` | No login UI |

### Confidential server login

For an app that owns its server session cookie, use `@sigid/backend` for
confidential code exchange, ID-token verification, and hosted logout. Follow
[Backend SDK](https://docs.sigid.org/developers/backend-sdk.md). Resolve
[Integration Settings](https://docs.sigid.org/developers/integration-settings.md)
first; setup's generic environment output needs framework-specific mapping and
does not configure custom API audiences or scopes.

### Backend token validation (required for protected APIs)

Validate access tokens with the SDK (`validateAccessToken` / framework helpers). Check signature, `iss`, `aud`, `exp`, tenant, scopes, subject type, and `act` when present. Do not authorize from frontend session state alone. Do not key users by email; use validated pairwise `sub` + tenant.

### Agent cold start (provision app + credentials)

```bash
npx @sigid/cli setup --name <app> --redirect-uri <callback-or-page-url>
# prints client_id, env_block, start_snippet – paste those; do not invent OIDC glue
npx @sigid/cli verify-setup
```

HTTP: `POST https://auth.sigid.org/api/v1/agents/workspace/bootstrap/pow` then `/complete` (ADR 0010).

### Explicitly forbidden for agents wiring login

- Implementing Authorization Code + PKCE by hand
- Building `/auth/callback` + token POST + JWKS verify for interactive login when `@sigid/start` or a framework SDK fits
- Putting `client_secret` in browser code
- Using email as the primary user key
- Logging tokens, codes, secrets, or private keys

## Best Starting Points

- [SigID quickstart](https://www.sigid.org/quickstart.md): shortest correct path (setup → paste snippet).
- [Developer integration guide](https://www.sigid.org/developers.md): SDK tiers and backend validation.
- [Agent identity guide](https://www.sigid.org/agents.md): registration, challenge-response, anchors, delegation.
- [Answer snippets](https://www.sigid.org/answers.md): concise quotable answers.
- [Full LLM context](https://www.sigid.org/llms-full.txt): one-file overview.
- Drop-in script: `https://cdn.sigid.org/v1/sigid.js`

## Public Pages

- [Overview](https://www.sigid.org/index.html.md)
- [Product architecture](https://www.sigid.org/product.md)
- [Developers](https://www.sigid.org/developers.md)
- [Pricing](https://www.sigid.org/pricing.md)
- [Security](https://www.sigid.org/security.md)
- [About SigID](https://www.sigid.org/about.md)
- [Contact SigID](https://www.sigid.org/contact.md)
- [Privacy and data handling](https://www.sigid.org/privacy.md)

## API Discovery

- [OpenAPI 3.1 specification](https://auth.sigid.org/openapi.json)
- [Interactive API reference](https://auth.sigid.org/api/docs)
- [OIDC discovery](https://auth.sigid.org/.well-known/openid-configuration)
- [OAuth protected-resource metadata](https://auth.sigid.org/.well-known/oauth-protected-resource)
- JWKS URI from OIDC discovery
- [Agent workspace bootstrap (ADR 0010)](https://auth.sigid.org/api/v1/agents/workspace/bootstrap/pow): cold-start for agents; prefer `npx @sigid/cli setup`
- [Agent challenge](https://auth.sigid.org/api/v1/agents/auth/challenge)
- [Agent verify](https://auth.sigid.org/api/v1/agents/auth/verify)
- [Agent registration](https://auth.sigid.org/api/v1/agents/auth/register)
- [Agent PoW registration](https://auth.sigid.org/api/v1/agents/auth/register/pow)

## Sites

- [Documentation](https://docs.sigid.org/)
- [Your account](https://identity.sigid.org/)
- [Tenant dashboard](https://dashboard.sigid.org/)
- [Hosted auth](https://auth.sigid.org/)

## Optional

- [Docs llms.txt](https://docs.sigid.org/llms.txt)
- [Docs full LLM context](https://docs.sigid.org/llms-full.txt)
- [OAuth and OIDC reference](https://docs.sigid.org/reference/oauth-oidc/) – only when the user needs full protocol control
- [Agent self-serve quickstart](https://docs.sigid.org/developers/agent-quickstart.md)
- [Agent auth reference](https://docs.sigid.org/developers/agent-auth/)
- [SDK reference](https://docs.sigid.org/reference/api-sdk-reference/)