Security

Security claims you can verify, not just trust.

We use the strongest verification each provider makes practical and say clearly when your service must trust MyLogin.world.

What the design guarantees

Outbound-only

Your instance opens HTTPS connections to MyLogin.world, which never connects to your address, never trusts your certificate, never proxies traffic.

Asymmetric instance keys

Each instance generates an Ed25519 key pair locally. Only the public key is registered. API calls carry a 60-second signed assertion with a single-use identifier.

Short-lived, single-use results

A completed login is fetched once, by the instance that created it, within about a minute. It is bound to the browser session that started it.

Provider evidence where possible

Providers that sign a nonce-bound identity token are labelled provider-verified. When your service must trust MyLogin.world, the login says so.

Local sessions

After verification your app creates its own session, and MyLogin.world is not on the request path.

Key rotation

Signing keys publish through JWKS with overlap. Instances rotate their own keys without downtime.

No account merging by email

An identity is linked to an existing account only after the user proves control of it.

Data minimisation

Provider tokens are discarded after the identity is read. Each service sees a pairwise subject, not a global one.

Rate limiting and audit

Login starts, callbacks, code entry, and second factors are rate-limited. Every security-relevant change is in your audit log.

Passkeys

Face ID, Touch ID, Windows Hello, or a security key. Register a passkey once with MyLogin.world and use it on every service you add. Nothing to type, nothing to phish.

How it is verified

The passkey public key is held by MyLogin.world, which checks the signature on each login and sends your service a signed result. Login screens and audit entries label it as a MyLogin.world-verified passkey.

Found something? See the vulnerability disclosure policy.

Give your app a real sign-in today.

Free for personal use. Supporter is $5 a year when you outgrow it.