Sign in with someones.computer
An OpenID Connect (OIDC) client lets your own application use someones.computer accounts as its sign-in. A person selects "Sign in with someones.computer" on your site. They sign in here, and your site learns who they are. Your site holds no password.
This differs from the access gate. The gate is a yes or no check at the edge, for an app with no sign-in of its own. An OIDC client suits an app that has its own sign-in screen and wants this as one option. Both can apply to one app.
The developer page at /developers covers the protocol: claims, flow, and endpoints.
Who can sign in through it
A client on an application accepts one kind of person: a member of the application's organization. The platform turns everyone else away.
The ID token carries the account's identifier (sub), the email, whether the address has a
confirmation, and the organization with the person's role in it.
Registering a client
- Open the application and select OIDC clients. Only an owner or admin of the organization can open the page.
- Enter a Name. The consent screen shows it to the person.
- Enter the Redirect URIs, one on each line. Each line must be a full
http://orhttps://address. Register every callback you use, including the local one. - Tick Require PKCE if your client sends a Proof Key for Code Exchange (PKCE). The box is off by default.
- Select Register client.
The page shows the client secret once, under Client registered, copy the secret now. The platform keeps only a hash. Nobody can read the secret back. If you lose it, revoke the client and register a new one.
Revoking a client
The list shows each client with its name and its PKCE setting. Select Revoke and confirm. Everyone who signed in through that client must sign in again.
Platform clients
Platform administrators register clients for the whole platform, such as the container UI. Those live under the admin pages. A client on an application admits only its organization's members.