The login happens on our origin. Your app only connects out.
Providers need a public HTTPS redirect. That redirect is MyLogin.world, for every app, and your app receives the result over a connection it opened itself. Not a tunnel, not a proxy: your app’s own traffic never routes through us, only the sign-in does.
The basic flow
- A user clicks Sign in on your private service.
- The service starts a MyLogin.world login transaction over an outbound HTTPS call.
- The user authenticates at MyLogin.world and, where applicable, at the identity provider.
- The service fetches the signed result over the same outbound connection.
- The service verifies the result and creates its own local session.
Existing sessions stay local
Only new sign-ins and account changes go through MyLogin.world. Once your app has its own session, ordinary use does not depend on it. An outage cannot sign anyone out.
Nothing is delivered to a private IP through the browser: no callback URL, no token in a query string.
Verification modes
Providers differ in what they can prove. Every login screen and audit entry names the mode used.
The identity provider signs evidence containing a value your service created. Your service verifies the signature itself.
PROVIDER_SIGNED_NONCEYour service talks to the provider directly; the provider token never reaches MyLogin.world.
DIRECT_DEVICEThe provider signs the identity token but does not bind it to your transaction.
PROVIDER_SIGNED_UNBOUNDYour service stores the passkey public key and verifies signatures itself.
DIRECT_PASSKEYThe passkey is registered with and verified by MyLogin.world, which stays in the trust boundary.
BROKER_PASSKEYThe provider response is verified by MyLogin.world, which signs the result for your service.
BROKER_ATTESTEDGive your app a real sign-in today.
Free for personal use. Supporter is $5 a year when you outgrow it.