Skip to content
Menu

Developers

Built for the afternoon you have.

Standard OIDC on the outside. A typed SDK, a React component, and a CLI that does the boring parts. If a quickstart step needs explaining, that is a bug we fix.

Quickstarts

Path A

Primary login

Replace password and social login.

terminal
# Path A: primary login
npx create-next-app@latest my-app && cd my-app
npx identizen init          # register site, write .env.local, scaffold app/api/auth/*
npm install && npm run dev  # open /api/auth/login

Path B

MFA and transaction approval

Keep your login. Add a phone-signed approval.

server/step-up.ts
// Path B: step-up after your own login
import { createIdentizenServer } from '@identizen/sdk/server';
const idz = createIdentizenServer({ indexUrl, clientId, clientSecret });

// 1. bind once: redirect to idz.authorizationUrl({ ..., prompt: 'enroll' }), store claims.sub
// 2. later, from any backend:
const v = await idz.verify({ sub, reason: 'Approve wire of $12,000 to Acme?' });
const done = await idz.waitForVerification(v.verification_id);
if (done.status === 'approved') { /* the assertion binds the reason hash */ }

Packages

Three packages, one npm install.

  • @identizen/sdk

    Browser core (discovery, challenge session, pairing, QR) and server helpers (OIDC exchange, Verification API, webhooks, back-channel logout) for Node, Bun, and Workers.

  • @identizen/react

    <IdentizenProvider>, <IdentizenButton>, <IdentizenStepUp>, useIdentizen(). Accessible states for code, QR, waiting, approved, denied.

  • identizen

    The CLI. init registers your site and scaffolds routes; dev runs a fake phone; register-site for CI.

Claims

What your site receives

An id_token with these claims. No email: if you need one, ask the user after login like any app.

Claim Value
sub Stable per-site identifier (derived key hash). Two sites cannot match a user by it.
sid Session id; back-channel logout revokes by it.
acr idz:login (primary) or idz:mfa (step-up).
amr What verified the person: ["face"], ["fingerprint"], ["pin"], …
auth_time When the person approved on the phone (unix seconds).
idz_device Device id for your own session / device UI, derived per site like sub.
idz_handle Optional human handle, only with the handle scope and only if set.
idz_org Org identifier for org identities (enterprise).

Self-host

Self-host in one command

The same code runs index.identizen.com. Deploy the index as a Cloudflare Worker with Postgres behind Hyperdrive, or run the container, on a domain you own. Your users keep the Identizen app; you host only the index. Configuration by environment variables only. Federation over WebFinger means your index and ours resolve each other's handles.