Sign in with Tagl ID — for developers

Add passwordless sign-in to your site or app. Tagl ID is a standard OpenID Connect provider: if your stack already speaks OIDC (most auth libraries do), integration is configuration, not code.

Why integrate

• No passwords to store, leak, or reset. Users authenticate with cryptographic keys they hold themselves.
• Minimal PII by design. You receive the user's identifier and, only with the profile scope and the user's explicit consent, the profile claims shown on the authorization screen. No profile dump — less personal data on your side means less GDPR surface.
• Standard protocol. Authorization Code flow, discovery document, JWKS — the same machinery as any major OIDC provider. No proprietary SDK required.

How it works

1. Your site redirects the user to Tagl ID's authorization endpoint.
2. The user approves the request locally, using the keys inside their tagl — a PNG file they hold. Keys never touch your servers or ours.
3. Your site receives a standard authorization code and exchanges it for tokens.

From your side, it is indistinguishable from any OIDC integration.

Integrating with an AI agent

Building with Claude, GPT, or another coding agent? Point it at our machine-focused spec: https://id.tagls.com/llms.txt. It contains everything an agent needs — endpoints, exact flow, verification rules, and a checklist — validated against a reference integration.

Integration steps

1. Register your application. Registration is self-service: sign in to your Tagl ID dashboard and create an application in the Developers tab — set your redirect URIs and receive a client ID.
2. Point your library at discovery. All endpoints, supported scopes, and signing keys are published in the standard discovery document: https://id.tagls.com/.well-known/openid-configuration Configure your OIDC library with it — most accept a single issuer/discovery URL. Use what discovery publishes; do not hard-code endpoint URLs.
3. Use Authorization Code flow. Supported scopes: openid (required) and profile. With profile, and only after user consent, the ID token / userinfo include name and birthdate. Validate ID tokens as your library does by default (issuer, audience, signature, expiry), and create an application session only after successful validation.
4. Handle unsuccessful attempts. If authorization is cancelled or fails, leave the user unauthenticated and offer a clear retry. An unavailable Tagl ID must never result in an authenticated session.

Protect your users' tagls

Your integration talks to Tagl ID over OIDC — nothing else is ever needed. Never ask a user to provide your application with:

• their tagl file;
• their PIN;
• their private keys or TOTP secrets.

A site asking for any of these is, by definition, phishing. Request only the scopes your sign-in flow requires, and describe your own processing in your privacy policy.

Beta notes

The Service is in public beta: expect changes, and rely only on behavior published in the discovery document and this documentation — do not assume support for flows, claims, or session features that are not explicitly documented. Breaking protocol-visible changes will be announced to registered application owners.

Questions and integration help: [email protected].