The login happens on our origin. Your app only connects out.
OAuth redirects and WebAuthn need a public HTTPS origin, and that origin is MyLogin.world, for every app. Your app receives the result over a connection it opened itself and verifies it there: not a tunnel, not a proxy, and none of your traffic routed through us.
The basic flow
- A user clicks Sign in on your private app.
- The app asks MyLogin.world for a login page and tells it which buttons to show.
- The user signs in with the provider, or with a passkey, at <service>.login.mylogin.world.compas.cs.stonybrook.edu.
- The app fetches the result over its own outbound connection.
- The app verifies the result and creates its own session.
Existing sessions stay local
Only new sign-ins go through MyLogin.world. Once your app has its own session, ordinary use does not depend on us, and an outage cannot sign anyone out.
Nothing is delivered to a private address through the browser: no callback URL on your network, and no token in a query string.
Two ways to use OAuth
Both options use the same redirect URI, and both end with your app holding an identity it verified.
Managed client
Use our provider client, with nothing to register. The result is an ID token bound to the nonce your app chose; your app verifies it, and we keep no copy after delivery.
Your own client
Register one redirect URI with the provider and keep the client secret in your app. We deliver the authorization code; your app exchanges it, so your secret and your tokens stay with you.
Passkeys
The ceremony runs on your service address, which gives WebAuthn the domain it asks for. The credential public keys are stored by your app, and your app checks the signature on each sign-in.
Give your app real login buttons.
All features are totally free. Want to help us out? Supporter is $5 a year, less than a frappuccino.