Skip to content

Passkey sign-in

One sign‑in across Holochain.

Use a passkey with apps that use hApp Auth. Choose what each receives, and manage your connections in one place.

Add sign-in to your appSee how Proofs work
hApp Auth

wants to know it’s you

  • Your ID for this siteRequired
  • Your name and picture
  • Your email address

Not you?

You can disconnect this site any time at happauth.com/account

Interactive sign-in example. Turn a field off and press Continue. Nothing is sent to a site.

Optional reputation

In development

Take your reputation with you.

Share proof of what you've done with the apps you choose.

We're building proofs: statements checked by an app that you can choose to share with another app. First, the projects you maintain.

How it works

Interactive example · fictional project

quickhapp.com

asks for a maintainer proof

Purpose: open this project's website.

Project maintainer · SolarisChecked by hAppRadar

Choose whether to include this proof. This example shares nothing.

How we're building it

  1. 01

    An app confirms something specific.

    hAppRadar checks your claim to maintain a particular project.

  2. 02

    You choose what to share.

    Inspect the proof and its source. Choose the recipient and purpose, or keep it private.

  3. 03

    Each app sets its own rules.

    The receiving app checks the evidence and decides what it accepts for that action.

Sharing a proof is optional; an app may need a relevant proof for a particular action.

01For people

Yours to hold, and yours to take back.

  1. 01

    One passkey, wherever you see the button.

    Your face, fingerprint or device PIN signs you in to every site that carries the button. There is no password to lose. GitHub and an email code work too.

  2. 02

    Your devices are one you. Coming

    Link the agent keys on your laptop and your phone, and a network can learn they are the same person, inside that network only. Your keys never leave your devices; we never hold them.

  3. 03

    Your connections, with a revoke control.

    Review your connected sites and agents, and revoke their access from one page. Third-party sites get different IDs for you. Information you choose to share can still identify you.

happauth.com/accountSample account
  • happradar.com
    Name, email, GitHub · used 2 days ago
  • quickhapp.com
    Name, email · used today
  • Claude Code
    Agent · publish to your QuickhApp site · used 1 hour ago

02For developers

Sign-in in ten lines.

Any OpenID Connect library works. Your client ID is a URL you host, so there is no form to fill, no secret to keep and no one to approve you.

import * as oidc from "openid-client";
const config = await oidc.discovery(new URL("https://happauth.com"),
  "https://yoursite.example/oauth/client.json", undefined, oidc.None());
const verifier = oidc.randomPKCECodeVerifier();
const signInUrl = oidc.buildAuthorizationUrl(config, { scope: "openid profile",
  redirect_uri: "https://yoursite.example/callback", code_challenge_method: "S256",
  code_challenge: await oidc.calculatePKCECodeChallenge(verifier) });
const tokens = await oidc.authorizationCodeGrant(config, callbackUrl,
  { pkceCodeVerifier: verifier });
const { sub } = tokens.claims()!;

Lines 2–3 find hApp Auth, 4–7 send the person to it, 8–10 turn the code into the person. callbackUrl is the address hApp Auth sends them back to.

  • Standard OpenID ConnectAuthorization code with PKCE, discovery, ID tokens. The library you already use.
  • A private ID per siteEach third-party site gets its own subject for a person, so sites cannot join their records by it.
  • Assurance you can readEvery ID token says how the person signed in: passkey, GitHub or email code. Agent-key sign-in is in development.
  • Agents, the same wayAn MCP client asks on the same sheet and holds a short token the person can revoke.

03For hApp makers

Admission rules a DNA checks offline.

We’re building signed facts about a person, each bound to one network and one agent key. Your integrity zome will check one signature when the agent joins. No server will be asked at validation time.

Coming
  1. 01

    GitHub account age

    Older than 90 days, a year or three years.

  2. 02

    Maintainer of a listed project

    Proven on hAppRadar, read from the radar's claim proof.

  3. 03

    An address at a domain

    The verified domain, never the address.

# dna.yaml — the network's admission policy lives in its properties
properties:
  happ_attestation_roots:
    - "<hApp Auth's 32-byte root key>"
    - "<another issuer's root key>"     # several issuers are normal
  happ_attestation_accept:
    - claim_type: github-age
      min_value: 365                     # days

Said plainly

A membrane decides who joins. It cannot evict an agent who already joined, it does not gate who connects or reads, and an expiry inside validation is advisory. Hard eviction is a new network epoch.

04The button

One button, on every site, the same.

Recognition is the security feature: a person who has pressed the real button forty times notices a fake. Place it; never restyle it.

EmeraldThe default, on light grounds
WhiteOn dark grounds, and beside other providers' buttons

One height

44 px, everywhere.

Anatomy

The mark at 0.6 × the height, the label at 0.36 ×, corners 0.22 ×.

One label

“Sign in with hApp Auth” or “hApp Auth ile giriş yap”. No other wording.

To place it Coming

A 2 KB web component and an SVG set.

Free, independent, and yours to take back.

hApp Auth has no plan and no price. Sites get sign-in; the people on them keep their keys.

Read the quickstartHow we handle security