Security claims you can verify, not just trust.
We use the strongest verification each provider makes practical and say clearly when your service must trust MyLogin.world.
What the design guarantees
Outbound-only
Your instance opens HTTPS connections to MyLogin.world, which never connects to your address, never trusts your certificate, never proxies traffic.
Asymmetric instance keys
Each instance generates an Ed25519 key pair locally. Only the public key is registered. API calls carry a 60-second signed assertion with a single-use identifier.
Short-lived, single-use results
A completed login is fetched once, by the instance that created it, within about a minute. It is bound to the browser session that started it.
Provider evidence where possible
Providers that sign a nonce-bound identity token are labelled provider-verified. When your service must trust MyLogin.world, the login says so.
Local sessions
After verification your app creates its own session, and MyLogin.world is not on the request path.
Key rotation
Signing keys publish through JWKS with overlap. Instances rotate their own keys without downtime.
No account merging by email
An identity is linked to an existing account only after the user proves control of it.
Data minimisation
Provider tokens are discarded after the identity is read. Each service sees a pairwise subject, not a global one.
Rate limiting and audit
Login starts, callbacks, code entry, and second factors are rate-limited. Every security-relevant change is in your audit log.
Passkeys
Face ID, Touch ID, Windows Hello, or a security key. Register a passkey once with MyLogin.world and use it on every service you add. Nothing to type, nothing to phish.
How it is verified
The passkey public key is held by MyLogin.world, which checks the signature on each login and sends your service a signed result. Login screens and audit entries label it as a MyLogin.world-verified passkey.
Found something? See the vulnerability disclosure policy.
Give your app a real sign-in today.
Free for personal use. Supporter is $5 a year when you outgrow it.