The history of IndieAuth.com

IndieAuth.com began as an implementation of RelMeAuth, originally proposed by Tantek Çelik in February 2010. The original algorithm was described in a short text update on Tantek's website. Later that evening, Jeff Lindsay and Paul Tarjan implemented RelMeAuth in an open source Python library at Hacker Dojo and discussed and tested it in IRC.

In 2011, we held the first IndieWebCamp in Portland. The registration process involved setting up OpenID on your own domain (or delegating your domain to an OpenID provider), signing in to the IndieWebCamp wiki and adding yourself to the guest list. Most people were able to complete this intentional barrier to entry, but there were still parts that were cumbersome.

It was suggested that for the 2012 IndieWebCamp, we handle registrations via RelMeAuth instead, to slightly lower the barrier to entry. I shuddered at the daunting task of writing multiple OAuth clients as MediaWiki extensions in order to support RelMeAuth. It was then that the idea of IndieAuth.com was born.

What I needed was to write the RelMeAuth and OAuth client code once and be able to use it on any website needing authentication from then on. I built IndieAuth.com as a hosted service that anyone could use if they wanted to support RelMeAuth logins. By abstracting the rel="me" and OAuth client logic into a very simple HTTP and JSON interface, it became possible to quickly write a web page needing authentication by relying on IndieAuth.com to do the legwork.

In March 2012, I built a prototype of the site and gave a quick explanation in the #indiewebcamp IRC channel. A few days later, I launched it on indieauth.com.

That simple interface grew into the IndieAuth specification, an identity layer on top of OAuth 2.0 that lets any website be its own identity provider, and lets people choose which server speaks for their domain. Signing in to websites for developers moved to indielogin.com.

Passkeys

Over a decade later, most of the services RelMeAuth relied on had changed or removed the APIs that made it work, and the original Ruby code had fallen far behind the libraries it was built on. This version of the site is a rewrite with a different approach: instead of borrowing your identity from another service, your account here is secured with passkeys, and your domain links to it directly with rel="indieauth-metadata". It implements the current IndieAuth specification, including access tokens for Micropub and other APIs on your own website.

You can read more about IndieAuth on the IndieWeb wiki.