Help
Frequently asked questions
- What is IndieAuth?
- IndieAuth is an identity layer on top of OAuth 2.0. It lets you use your own website as your identity: apps ask your website which server to trust, and that server confirms it is really you.
- Why a passkey instead of a password or my GitHub account?
- A passkey cannot be phished, reused or leaked in a breach, and it works across your devices. Relying on another service's login meant your identity depended on that service's policies and APIs, which change. Here, your domain and your passkey are all it takes.
- Do I need my own domain?
- Yes. Your domain is your identity, so you need a website at a domain you control and the ability to add a
<link>tag to its home page. - Can I use more than one domain?
- Yes. Add as many as you like to your account. When you sign in to an app, you type the domain you want to be — each is verified separately.
- What happens if I lose my passkey?
- If you added passkeys on other devices, or use a passkey manager that syncs, you can keep signing in and add a new one. Otherwise, contact whoever runs this server: they can issue a one-time recovery link after confirming it is you.
- What if my domain changes hands?
- The
indieauth-metadatalink on the home page decides which account a domain belongs to. If a new owner links it to their own account and verifies it, it moves to their account and every token issued under the old account for that domain stops working. - Does this server see my passwords or posts?
- No. It never has a password to see, and it is not involved when an app talks to your Micropub endpoint — only when your endpoint asks whether a token is valid.
- Can I run my own copy?
- Yes. It is a small PHP application backed by MySQL and Redis; point your domain's
indieauth-metadatalink at your own installation instead. - What happened to the old indieauth.com features?
- Signing in with GitHub, Twitter, email, PGP keys and OpenID were retired along with the old code. Developers who used indieauth.com to sign people in should use indielogin.com. You can read how the site came to be in its history.