Documentation¶
Omxus is an emergency network of the people nearby, plus the identity, vouching and voting that run it, held by the people who use it, not a company. These docs show how to build on it.
The shortest possible integration¶
If your framework already speaks OpenID Connect — NextAuth, passport, Auth0 style configs, almost every auth library — point it at the issuer and you are finished:
issuer: https://auth.omxus.com
client_id: from auth.omxus.com/developers
client_secret: (none for a browser app)
scope: openid profile
PKCE: S256, required for every client
Everything else is discovered from
https://auth.omxus.com/.well-known/openid-configuration.
Do it with OIDC Or keep people signed in everywhere
What a person experiences¶
With an Omxus identity (a passkey):
| Visit | What they do |
|---|---|
| First, on a new device | Press one button. Face ID or fingerprint. In. |
| Every visit after | Nothing. They arrive already signed in. |
| A device they have never used | Press one button again. |
| Every device lost, if they set up recovery | Type the words they saved once. |
| Every device lost, with no recovery | The identity is gone. Said plainly, up front. |
There is no password anywhere in that table
Not a weak one, not a strong one, not one in a manager. The key is made on the device and unlocked by the same gesture that unlocks the phone.
A site can also offer ordinary accounts (email or mobile, username, password, passkey): the standard door. See Your own sign-in page.
What crosses the wire¶
For an Omxus identity: a signature over a number your server invented a moment ago. Never a key, never a phrase, never a password, never an email.
That is why a copy of your database is worth nothing to whoever takes it. On the standard door the browser sends a stretched hash of the password, never the password: see Security model.