Documentation

Setting up your website

Use your own domain name to sign in to apps across the IndieWeb, with myindieauth.com handling the sign-in.

What you need

A website on a domain you control, such as example.com, where you can edit the HTML of the home page (or set HTTP headers).
A device that supports passkeys: any recent phone, computer or hardware security key.

1. Create an account

Create an account with a username and a passkey. The username only matters on this site; everywhere else, your domain is who you are.

Add a passkey on every device you use from your account page, so losing one device does not lock you out.

2. Connect your domain

From your account, choose Add a domain and enter your domain. You will be shown a tag like this, which is unique to your account:

<link rel="indieauth-metadata" href="https://dev.myindieauth.com/u/your-id/metadata">

Put it in the <head> of your home page, then press Verify. If you cannot edit your HTML, you can send an HTTP header instead:

Link: <https://dev.myindieauth.com/u/your-id/metadata>; rel="indieauth-metadata"

This link does two things. It tells apps which server to send you to when you sign in with your domain, and it proves to this server that the account adding the domain is the one its owner chose. Keep it on your site for as long as you use this server: it is checked again from time to time.

Wherever you see a "Sign in with your domain" or "Web sign-in" box, type your domain. You will be sent here, asked to confirm with your passkey if you are not already signed in, and shown which app is asking. Approve it and you are signed in.

For example, the IndieWeb wiki signs people in through indielogin.com, which will find the link on your home page and send you here.

Micropub and other APIs

Apps that publish to your website, such as Micropub clients, ask for permissions (scopes) like create or media. When you approve, the app receives an access token and sends it with each request to your site's endpoint.

Your endpoint then needs to check that token with this server. Create a resource server credential for it and follow verifying access tokens.

You choose how long access lasts when you approve. Tokens can renew themselves while you keep using the app (recommended), or never expire for older apps that cannot renew. Either way, you can revoke any app from connected apps.

Moving from indieauth.com

If your site used the original indieauth.com, it probably has tags like these:

<link rel="authorization_endpoint" href="https://indieauth.com/auth">
<link rel="token_endpoint" href="https://tokens.indieauth.com/token">

Replace them with the indieauth-metadata link for your account. Some older apps only look for the separate endpoint links, so you may also point those at this server:

<link rel="authorization_endpoint" href="https://dev.myindieauth.com/auth">
<link rel="token_endpoint" href="https://dev.myindieauth.com/token">

The indieauth-metadata link is still required: it is how this server knows the domain belongs to your account. The rel="me" links to GitHub, email and so on are no longer used for signing in here, but you are welcome to keep them on your site.

Once your domain is verified, its page on your account shows the history of apps you signed in to through indieauth.com.

Troubleshooting

Verification says my site redirects: Only the home page of a domain can be verified. If example.com redirects to www.example.com, add www.example.com instead — that is the URL apps will see.
Verification cannot find the tag: Check that the tag is in the HTML your server sends (view source, not the browser's inspector), that the URL matches exactly, and that nothing such as a login wall or bot protection blocks requests from this server.
An app says the sign-in was for the wrong site: Apps check that the website you signed in as links back to this server. Make sure the domain you typed in the app is the same one that is verified on your account.