# SigID Docs Full LLM Context

SigID Docs are the canonical public instructions for using SigID as a hosted identity provider for humans and AI agents. SigID provides OAuth 2.1, OpenID Connect, passkeys, MFA, enterprise SSO, wallet sign-in, agent identity, delegated access, wallet policy, x402 authorization, webhooks, and audit.

This is a curated orientation, not a concatenation of the entire documentation.
Use it to choose the next guide; follow [llms.txt](https://docs.sigid.org/llms.txt)
for links to the detailed Markdown pages.

## How Agents Should Use This Docs Site

Every documentation page is available as raw Markdown. Convert an HTML page URL to Markdown by replacing the trailing slash with `.md`:

- HTML: `https://docs.sigid.org/developers/quickstart-nextjs/`
- Markdown: `https://docs.sigid.org/developers/quickstart-nextjs.md`

Section indexes follow the same rule:

- HTML: `https://docs.sigid.org/developers/`
- Markdown: `https://docs.sigid.org/developers.md`

Each page may contain hidden agent instructions:

- `<!-- agent:page ... -->` gives page-level implementation guidance.
- `<!-- agent:action ... -->` gives step-level implementation guidance near an action point.

Read those comments before editing code or giving integration instructions.

## Role Routing

Send users to the right section:

- Individual: sign-in help, passkeys, MFA, account recovery, connected apps, consent, sessions, privacy.
- Developer: workspace setup and administration (the stable `/business/*` URLs), hosted login, OAuth/OIDC, token validation, protected APIs, SDKs, webhooks, agent auth, MCP, wallets.
- Reference: exact protocol, claims, scopes, API surfaces, webhooks, security model, configuration, troubleshooting, glossary.

For a new evaluation, first use [Agent Quickstart](https://docs.sigid.org/developers/agent-quickstart.md): `npx @sigid/cli setup` creates the sandbox tenant, app and fixture human without a dashboard session. Existing managed workspaces use their authorized admin handoff.

## Developer Integration Path

Choose the existing runtime and session architecture first:

| Application | Guide |
|---|---|
| Plain HTML / static page | [Add Login](https://docs.sigid.org/developers/add-login.md): `@sigid/start`, inline callback |
| Next.js App Router, browser OAuth session | [Next.js](https://docs.sigid.org/developers/quickstart-nextjs.md) |
| React SPA | [React](https://docs.sigid.org/developers/quickstart-react-spa.md) |
| Server-owned cookie session | [Backend SDK](https://docs.sigid.org/developers/backend-sdk.md): `@sigid/backend` |
| API-only token verification | [Backend API](https://docs.sigid.org/developers/quickstart-backend-api.md) |
| Agent provisioning and delegation | [Agent Quickstart](https://docs.sigid.org/developers/agent-quickstart.md) |

Resolve [Integration Settings](https://docs.sigid.org/developers/integration-settings.md)
before implementation. Setup's generic `env_block` must be mapped to Next.js or
Vite variable names; API audience and allowed API scopes require separate
configuration. Use `tenant_id` (UUID) for validator `tenantId`, not a slug or
organization ID. Token verification requires public JWKS, not a client secret.

After login, validate access tokens and enforce resource access on the backend.
Add webhooks, commerce, vault, or MCP integration only when the app needs them.

## OAuth/OIDC Rules To Preserve

- Use OIDC discovery from the issuer.
- Use Authorization Code with PKCE for interactive user login.
- Match redirect URIs exactly.
- Use the registered token endpoint authentication method.
- Keep client secrets out of browser and mobile code.
- Verify `state`.
- Exchange authorization codes exactly once.
- Validate tokens server-side before creating sessions or serving protected data.
- Key app users on validated `sub` plus tenant context, not email.

Token validation must check signature, issuer, audience, expiry, not-before, tenant context, scopes, subject type, and delegated `act` claim where present.

## Agent Rules To Preserve

Agents are first-class principals. They can authenticate with challenge-response, client credentials for internal or legacy service cases, or token exchange for delegated access.

Challenge-response flow:

1. Request a tenant-scoped single-use challenge.
2. Sign the exact canonical payload with the registered private key.
3. Submit verification.
4. Validate returned tokens by signature, issuer, audience, expiry, tenant, scope, and `subject_type = agent`.

Agent registration must verify public key ownership, reject duplicate fingerprints, keep owner and tenant checks in the service boundary, and never expose private key material or OAuth client secrets.

Delegated agent-on-behalf-of access uses RFC 8693 token exchange and the `act` claim.
Agent-initiated human approval uses the device-style ceremony in
`developers/agent-quickstart.md` (`POST /api/v1/agents/delegations/device`).

## Public URLs

- Product site: `https://www.sigid.org/`
- Product LLM guide: `https://www.sigid.org/llms.txt`
- Product quickstart: `https://www.sigid.org/quickstart.md`
- Docs: `https://docs.sigid.org/`
- Docs LLM guide: `https://docs.sigid.org/llms.txt`
- Identity: `https://identity.sigid.org/`
- Dashboard: `https://dashboard.sigid.org/`
- Hosted auth: `https://auth.sigid.org/`

## Pages

- `index.md` - docs home and role routing
- `individuals.md` - account help overview
- `individuals/sign-in.md` - sign-in help
- `individuals/passkeys-mfa.md` - passkeys and MFA
- `individuals/recovery.md` - account recovery
- `individuals/connected-apps.md` - consent and connected apps
- `individuals/sessions-privacy.md` - sessions and privacy
- `business.md` - workspace administration overview
- `business/workspace-admin-quickstart.md` - workspace admin quickstart
- `business/launch-workspace.md` - workspace launch checklist
- `business/tenants-applications.md` - tenants and applications
- `business/users-login-methods.md` - users and login methods
- `business/organizations-sso.md` - organizations and SSO
- `business/security-audit.md` - security and audit
- `business/billing-production.md` - billing and production readiness
- `developers.md` - developer overview
- `developers/integration-settings.md` - application settings and framework environment mapping
- `developers/backend-sdk.md` - confidential server login with an app-owned session
- `developers/quickstart-nextjs.md` - Next.js quickstart
- `developers/quickstart-react-spa.md` - React SPA quickstart
- `developers/quickstart-backend-api.md` - backend API quickstart
- `developers/run-example-app.md` - run the example app
- `developers/add-login.md` - add hosted login
- `developers/verify-tokens.md` - validate access tokens
- `developers/protect-apis.md` - protect backend APIs
- `developers/sdks-examples.md` - SDKs and examples
- `developers/webhooks.md` - receive webhooks
- `developers/agents-mcp.md` - agent and MCP auth
- `developers/agent-quickstart.md` - cold agent self-serve (bootstrap + device delegation)
- `developers/agent-auth.md` - agent challenge-response and client credentials
- `developers/registration.md` - agent registration
- `developers/delegation.md` - delegation and token exchange
- `developers/wallets.md` - agent wallets
- `developers/mcp.md` - MCP server integration
- `developers/cli.md` - agent CLI
- `reference/product-reference.md` - product surfaces and capabilities
- `reference/oauth-oidc.md` - OAuth/OIDC details
- `reference/claims-and-scopes.md` - token claims and scopes
- `reference/api-sdk-reference.md` - API and SDK reference
- `reference/webhook-events.md` - webhook event categories
- `reference/security-model.md` - security model
- `reference/server-configuration.md` - server configuration
- `reference/troubleshooting.md` - troubleshooting
- `reference/glossary.md` - terms and definitions