Introduction

An Origin Account signs you in with a passkey: a key your device or password manager keeps, which your fingerprint, face or PIN unlocks. There is no password to remember or leak. You can also link a GitHub or Google account to sign in with.

Your account lives at auth.sourceorigin.dev. Its settings, at auth.sourceorigin.dev/settings, manage your passkeys, email addresses, devices, the apps you signed in to, your notifications and your data.

Words this guide uses

• Handle: your account’s public name, such as alice. You sign in with it, and apps receive it. See your handle.

• Passkey: a credential bound to your account. An account can have several, one per device or password manager.

• Session: one device signed in to your account. Settings list your devices, and you can sign any of them out.

• App: a website or service that signs you in with your Origin Account. The first time, it asks for your consent, naming what it will receive. Apps SourceOrigin runs itself don’t ask.

  

• Passkey confirmation: sensitive changes, such as removing a passkey, need you to have used your passkey in the last five minutes. If you haven’t, Origin Auth asks for it again first, even though you are signed in. See passkey confirmation.

Your account

• Creating an account with a passkey, or starting from GitHub or Google.
• Signing in and signing out.
• Sign-in methods: adding and removing passkeys, and linking GitHub or Google.
• Profile: your handle, display name and picture.
• Email addresses: adding and confirming addresses, and choosing the one apps receive.
• Devices: the browsers signed in to your account.
• Connected apps: the apps that can use your account.
• Notifications: what SourceOrigin tells you, in your inbox and by email.
• Security history: every sign-in and change, and reporting what wasn’t you.

Your data

• Recover your account if you lost every passkey.
• Undo a recovery that wasn’t you.
• Download your data: everything SourceOrigin keeps about you, in one file.
• Delete your account, and restore it within 30 days.

Building an app

Any account can register apps in the developer console, at auth.sourceorigin.dev/developers. An app then signs its users in through OpenID Connect, with the Rust SDK (sourceorigin-auth), the TypeScript SDK (@sourceorigin/auth), or any OpenID Connect library:

• How sign-in works explains the concepts, and which SDK to pick.
• Registering an app covers the console, then changing an app’s settings and rotating its secret.
• Signing in with Rust, signing in with TypeScript and browser apps sign users in with the SDKs.
• Protecting an API validates access tokens.
• Developing on your machine and deploying with piqueld cover where your app runs.
• Step-up authentication asks for a fresh passkey before a sensitive action.
• Back-channel logout ends an app’s session when the user’s session at auth ends.
• Troubleshooting sign-in explains the errors your app may see.
• OpenID Connect lists the endpoints, tokens and claims.

Building with an AI coding agent? Building with coding agents explains what it can do for you, with skills to give it.