A boundary you can check, not just trust.
Your app owns its users, sessions, and access rules. We carry a sign-in result between the browser and your app, which is what the items below describe.
What the design means
Outbound-only
Your app opens the connections to MyLogin.world, which has no route to your address, no access to your certificate, and no traffic of yours to proxy.
Single-use results
A completed sign-in is delivered once, to the secret id of the transaction that started it, and the payload is deleted on delivery. It never travels in the browser URL.
No credentials to manage
There is nothing to install, register, or renew: a service is identified by its address on MyLogin.world, and a sign-in can only send the browser back to the app URL you configured.
No identities or tokens stored
We hold no user records and no credentials. A managed client’s tokens are discarded after delivery, and your own client’s tokens do not reach us.
Your app verifies
Your app checks the provider ID token or the passkey signature itself, decides who may sign in, and keeps the session. We make no access decision.
Rate limiting and audit
Sign-in starts, callbacks, and result collection are rate-limited. Configuration and security changes are recorded in your audit log.
Passkeys
Face ID, Touch ID, Windows Hello, or a security key. WebAuthn needs a real domain, and your service address on MyLogin.world provides one.
The credential public keys are stored by your app, which verifies each signature against the challenge it issued. Our page runs the ceremony and hands the raw response back.
Found something? See the vulnerability disclosure policy.
Give your app real login buttons.
All features are totally free. Want to help us out? Supporter is $5 a year, less than a frappuccino.