Sign in with Avonao ID
Let your members sign in with the Avonao ID they already have. It is standard OpenID Connect (the authorization code flow with PKCE), so any OIDC library works, and a hand-written integration is about 100 lines of server code.
Quickstart
Register your app, send members to Avonao ID, read who signed in. Node and curl examples that you can copy.
Button kit
The Sign in with Avonao ID button: live preview, copy-paste HTML, one stylesheet, SVG files.
What your app gets
- No passwords to handle. Members sign in at Avonao ID with an email link or code, a passkey or a social account, and an authenticator app when they turned it on.
- A stable id that is yours alone. The
subclaim is the same for every app of your business and different for every other business. Read about pairwise ids. - A verified email address when you ask for the
emailscope, and a display name and locale withprofile. - A consent screen that Avonao ID runs for you, with your app name, your business name and your verified domain. Members can revoke your app at any time, and you can hear about it through webhooks.
At a glance
| Setting | Value |
|---|---|
| Issuer | https://id.avonao.com |
| Discovery | https://id.avonao.com/.well-known/openid-configuration |
| Authorization endpoint | https://id.avonao.com/authorize |
| Token endpoint | https://id.avonao.com/token |
| Userinfo endpoint | https://id.avonao.com/userinfo |
| Signing keys (JWKS) | https://id.avonao.com/.well-known/jwks.json |
| End session endpoint | https://id.avonao.com/logout |
| Flow | Authorization code with PKCE (S256 only, required) |
| Client authentication | client_secret_basic or client_secret_post. Every app has a secret, so keep the token exchange on your server. |
| Scopes | openid, email, profile |
| ID token | A JWT signed with ES256, valid for 5 minutes |
| Not there | Refresh tokens, the implicit flow, token revocation and introspection endpoints, dynamic client registration, single logout |
All pages
- Quickstart: Register your app, send members to Avonao ID, and read who signed in. Authorization code flow with PKCE, with Node and curl examples.
- Pairwise subject ids: Why the sub you receive is yours alone, and how to link members to your own accounts safely.
- Verified claims: What Avonao ID tells you about a member: a verified email, and what it does not tell you (age, consent).
- Webhooks: Signed events when a member revokes your app or deletes their Avonao ID, and how to verify them.
- Errors: Every error code your app can see, where it appears, and the message to show.
- Security checklist: What to check before you go live.
- Button kit: The Sign in with Avonao ID button: live preview, copy-paste HTML, CSS and SVG files.
- Brand rules: How to use the Avonao ID icon and the button label.
- FAQ: Short answers to the questions that come up most.
Where to start, and where to ask
Create your business and app in the business console. Questions about your integration go to business-support@avonao.com.
Avonao ID
