For Developers¶
Use this section if you are administering a SigID workspace or adding SigID to an application, backend API, webhook receiver, or agent/MCP integration.
Start with the quickstart for your runtime and Integration Settings. You can evaluate with a sandbox application or use the settings supplied by your existing workspace admin.
Administer A Workspace¶
Workspace administration is part of the developer path. Start with the guide that matches the task before implementing the application integration.
| What you want to do | Read this |
|---|---|
| Prepare the first workspace and application | Workspace Admin Quickstart |
| Set up SigID from zero to launch | Launch Your Workspace |
| Understand workspaces, tenants, apps, and environments | Workspaces And Applications |
| Invite users and choose sign-in methods | Users And Login Methods |
| Configure organizations, SSO, or provisioning | Organizations And SSO |
| Review access, audit, and operational security | Security And Audit |
| Check billing, support, and production readiness | Go Live |
What SigID Is¶
SigID is the identity and account-security service your app uses instead of building login, sessions, consent, recovery, SSO, and token issuing yourself.
Your app sends users to SigID for sign-in. SigID checks the user, then sends the user back to your app with a result your code can handle. Your backend then trusts only validated SigID tokens, not frontend guesses about who the user is.
How Your App Uses SigID¶
- 1Get app settingsAsk the workspace owner for issuer URL, client ID, redirect URL, scopes, audience, and tenant or workspace ID.
- 2Add hosted loginUse the SDK to send users to SigID and handle the callback when SigID sends them back.
- 3Create an app sessionStore only the session data your app needs and support logout.
- 4Validate access tokens on the backendCheck issuer, audience, tenant, expiry, scopes, signature, and subject type before serving protected data.
- 5Protect each API boundaryDo not rely on hidden buttons or frontend state. Enforce access in backend code.
- 6Add webhooks or agent auth only when neededUse signed webhooks for async events and scoped principals for agents or MCP servers.
Choose The Right Page¶
| What you want to build | Read this |
|---|---|
| Wire SigID into a third-party codebase (agent checklist) | Integrate Third-Party App |
| Add sign-in to your app | Add Login To Your App |
| Check that SigID tokens are valid | Verify Access Tokens |
| Protect backend routes and resources | Protect Backend APIs |
| Pick the right package or example | SDKs And Examples |
| Sell paid access (payment links + webhooks) | Sell Access With SigID Commerce |
| Receive events from SigID | Receive Webhooks |
| Protect agents, tools, or MCP servers | Agent And MCP Auth |
| Cold agent self-serve (bootstrap + human delegation) | Agent Self-Serve Quickstart |
| Deliver an agent-built integration to a developer | Provision, Test, And Hand Off |
| Use vault credentials, call external APIs through egress, or sign SSH certs | Use Vault And Egress |
Start With A Quickstart¶
| What you have | Start here | You finish with |
|---|---|---|
| Plain HTML or static page | Add Login To Your App | Drop-in login with an inline callback and no build step |
| Server app with its own cookie session | Backend SDK | Confidential login, verified ID token, and your own app session |
| Next.js App Router app | Next.js Quickstart | Hosted login, callback, protected page, and protected API route |
| React browser app | React SPA Quickstart | Hosted login, callback, session UI, logout, and backend token handoff |
| Existing backend API | Backend API Quickstart | Bearer-token validation with tenant, audience, scope, and subject checks |
| Autonomous agent (no human-precreated workspace) | Agent Self-Serve Quickstart | Sandbox workspace, app, device delegation, delegated token |
| You want to see it running first | Run The Example App | Local SDK Lab app and quality gate |
Use the framework already in your project. The Next.js and React quickstarts keep the OAuth session in the browser and send access tokens to your API. For server-rendered authentication with an app-owned cookie, use the Backend SDK. An API that only validates incoming access tokens does not need a login client or client secret.
Use Reference when you need exact OAuth parameters, claims, scopes, API shapes, event names, error formats, or security model details.