View source for IndieAuth

You do not have permission to edit this page, for the following reason:
The action you have requested is limited to users in the group: Users.
You can view and copy the source of this page.
[[File:indieauth-2023.svg|frameless|right|128px|IndieAuth icon]]

'''<dfn>[https://indieauth.net/ IndieAuth]</dfn>''' is a federated login protocol for [[Web sign-in]], enabling users to use their own [[domain]] to sign in to other sites and services. IndieAuth can be used to implement <strong>OAuth2 login</strong> AKA <strong>OAuth-based login</strong>.

IndieAuth is built on ideas and technology from existing proven technologies like [[OAuth]] and [[OpenID]] but makes it easier for users as well as developers. It decentralizes much of the process so completely separate implementations and services can be used for each part.

{{note|Read More: [https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web IndieAuth: OAuth for the Open Web]}}

If you’re familiar with writing an OAuth client, then you're familiar with the problem of having to register your client manually with each OAuth provider. IndieAuth uses DNS as a replacement for client registration, thereby eliminating the need for any manual registration with providers.

{{warning|'''Note:''' IndieAuth is often conflated with the [[indieauth.com|IndieAuth.com]] service provider. The first is the subject of this page: ''the way the IndieAuth protocol works''. The second is ''a service'' that provides an authorization endpoint, and was also previously used by this wiki until the wiki switched to using [[indielogin.com]].}}

== Why ==

By choosing your IndieAuth provider, you can tell applications where to send you to sign in. This gives you more control over the privacy and security of your logins.

Most [[Micropub]] clients use [[IndieAuth]] to log you in, obtaining your authorization by directing you to your chosen IndieAuth server. This allows you to use your own website to log in to the tools you use to post content.

IndieAuth is part of taking back control of your online identity. Instead of logging in to websites as “you on Twitter” or “you on Facebook”, you should be able to log in as just “you”. We should not be relying on [[silos]] to provide our authenticated identities, we should be able to use our own [[personal domain|personal domains]] to log in to sites everywhere.

You can use it right now to log in to this wiki and contribute to the [[community]], including doing common things like:
* Adding yourself to [[chat-names]] after joining one of our [[discuss|discussion channels]], and
* RSVP to [[events|an upcoming event]].

== How it works ==
Basic flow with a user signing in to a (web) app
# '''The user fills in their personal URL''' This is called [[Web sign-in]].
# '''The app fetches the URL, looking for an authorization endpoint.''' For this, the user can use IndieAuth.com, but it can also be at their own domain. The app redirects the User to their authorization endpoint.
# '''The user authenticates at their own authorization endpoint.''' IndieAuth.com uses [[RelMeAuth]] to authenticate users, but if a user uses an authorization endpoint on their own site, it can be a password, e-mail link, or any other authentication mechanism the authorization endpoint provides. They prove their identity to their authorization endpoint while the app waits for them to complete.
# '''The authorization endpoint issues a temporary authorization code''', and sends it to the app by redirecting the user's browser back to the app.
# '''The app checks the code with the authorization endpoint''', and if the code is valid and if the user’s identifier matches the identifier the authorization endpoint gives, the login is completed, and the user can enter and use the app.

== How to ==
If all you're trying to do is log in to the wiki, then you may not need to set up IndieAuth at all! Instead, you can just link to your existing Twitter or GitHub accounts and the wiki will use those to authenticate you! See [https://indielogin.com/setup indielogin.com/setup] for more details.

=== Set up your own IndieAuth provider ===
Use an existing [[#Implementations|implementation]] or [[authorization-endpoint|build your own!]]

=== Set up in WordPress ===
If you use WordPress, you can install the [[Wordpress IndieAuth Plugin]] which provides a built-in IndieAuth server. If you have problems with the authentication header being stripped off by Apache (a common problem on hosting services like [https://Bluehost.com Bluehost.com]), the IndieAuth plugin should be disabled or removed, and the Micropub plugin should be used to provide authentication through IndieAuth.com.

=== Set up using IndieAuth.com ===
[[indieauth.com|IndieAuth.com]] is a service that allows you to sign in as your site by using your social media profiles. This is aimed at those who want to experiment with IndieAuth, and is not preferred as a long-term solution due its dependence on logging in via third-parties.

Your homepage and social media profiles need to link to each other for verification. Instead of registering for an account at indieauth.com, it uses your existing social media accounts to verify you own the URL you're signing in as.

# Add [[rel-me]] links to your homepage for various ways to reach you,<br>e.g. <code><nowiki><a href="https://github.com/aaronpk" rel="me">GitHub</a></nowiki></code>.
# Make sure any social media profiles you linked to have a link back to your homepage.
# Finally, include <code><link rel="authorization_endpoint" href="https://indieauth.com/auth"></code> on your homepage.

You are done! Try to log in to a site that supports IndieAuth, such as:
* [https://sso.indieweb.org/login?url=https%3A%2F%2Findieweb.org%2FIndieAuth this wiki]
* [https://telegraph.p3k.io/login Telegraph]
* [https://pin13.net/login/ this demo page on pin13.net]

These services should redirect you to your chosen IndieAuth endpoint to sign in, which in this case is indieauth.com.

See: [https://indieauth.com/setup full setup instructions]

== IndieWeb Examples ==
<span id="Users"></span>

The following people have an authorization endpoint on their own domain.

* {{aaronpk}} at https://aaronparecki.com/auth as of [https://aaronparecki.com/2016/04/13/8/indieauth 2016-04-13]. As of [https://aaronparecki.com/2017/10/04/23/passwordless-logins 2017-10-04], authentication is done via a push notification to his mobile phone rather than entering a password.
* {{sebsel}} has an authorization endpoint at https://seblog.nl/auth as of IndieWebWeek 2017 in Düsseldorf and Nürnberg. Since IndieWebCamp Düsseldorf 2021, he uses a rewritten version at the same URL.
* {{martijnvdven}} has an authorization endpoint on <code>http://vanderven.se/martijn/</code> as of 2017-06-30. Powered by [[selfauth]].
* {{jeena}} has an authorization endpoint at https://jeena.net/indieauth as of IndieWebCamp 2017 in Berlin
* {{mblaney}} has an authorization endpoint on https://unicyclic.com/mal as of IndieWeb Summit 2018.
* {{realize.be}} has an authorization endpoint on https://realize.be as of November 2018.
* {{pmc}} has an authorization endpoint on https://piperswe.me, [https://piperswe.me/posts/serverless-indieauth/ implemented with Netlify Functions].
* {{frank}} has an authorization endpoint on https://diggingthedigital.com/ as of February 2019. This is powered by the [https://wordpress.org/plugins/indieauth/ WordPress IndieAuth plugin]
* {{hammyhavoc}} has an authorization endpoint on https://www.hammyhavoc.com/ as of August 2022. This is powered by the [https://wordpress.org/plugins/indieauth/ WordPress IndieAuth plugin]
* {{ds}} has an authorization endpoint at https://dmitri.shuralyov.com/api/indieauth/authorization as of [https://github.com/shurcooL/home/commit/75d6ace272f1addb0a14b71da9a62169850ae222 2019-12-22]. Implemented in [[Go]].
* {{4x_pro}} in February 2021 implemented authorization endpoint on http://4xpro.ru, which is powered by Intellect Board forum/blog engine.
* {{capjamesg}} has an authorization endpoint at https://auth.jamesg.blog as of October, 2021. His endpoint supports Twitter, GitHub, and passwordless authentication via a mobile push notification. The push notification is developed with use of Okta's Verify product.
** {{capjamesg}}'s authorization endpoint is [https://github.com/capjamesg/jamesg-indieauth open-sourced on GitHub].
* {{jamietanna}} has an IndieAuth server at https://indieauth.jvt.me, built with (Java) Spring Boot.
** Jamie has blogged about the big updates to the service at https://www.jvt.me/tags/indieauth.jvt.me/
* {{hacdias}} has an IndieAuth server built-in into his custom CMS. It is implemented in [[Go]] using [[indielib]].

== IndieAuth Providers ==
<span id="Servers"></span>
Sites/services which provide their users with an IndieAuth server. In [[identity]] terms, these are identity providers (IDPs).

* '''[[Known]]''' provides a built-in IndieAuth server
* '''[https://observablehq.com/@endpointservices @endpointservices]''' hosts a forkable [https://observablehq.com/@endpointservices/auth IndieAuth notebook] server on the browser based IDE [https://observablehq.com Observablehq.com]
* '''[[Micro.blog]]''' implements IndieAuth for all hosted micro.blog subdomains as well as verified sites.
** [http://www.manton.org/2018/07/indieauth-for-micro-blog.html IndieAuth for Micro.blog]
** [http://www.manton.org/2018/07/indieauth-for-external-blogs.html IndieAuth for external blogs]
* '''[[IndieAuth.com]]''' is an implementation of [[Web sign-in]]/[[RelMeAuth]] with an HTTP API, used by many people as a quick way of adding IndieAuth support to their site by linking to existing silo accounts
* '''[[commentpara.de]]''' provides IndieAuth identities to anyone wishing to log in to a website anonymously.
* '''[[indieauth-openid]]''' converts an existing OpenID setup to work with IndieAuth
* <span id="Use_with_Micropub"></span>Most '''[[Micropub]]''' apps use IndieAuth to allow the app to post to your site
** [[Micropub/Servers]]
** [[Micropub/Clients]]

== Services ==
Hosted services which make developing IndieAuth-based applications easier.

=== IndieLogin.com ===
[[IndieLogin.com]] is a service that consumes IndieAuth. It authenticates users using [[IndieAuth]], [[RelMeAuth]], email and PGP, wrapping all the logic in a simple API. It is used by the indieweb.org wiki as well as other related projects to sign users in.

[https://indielogin.com/api Read the full documentation]

=== IndieAuth.com ===
The IndieAuth.com service provides an authorization endpoint to bootstrap your [[Micropub]] server development. It lets you authenticate via GitHub, email, and PGP. Eventually this will be replaced with a new service, [[MyIndieAuth.com]], although development of that service has not yet begun.

Historically, IndieAuth.com also provided an API for developers to use to authenticate users, tho this is being phased out in favor of [[IndieLogin.com]].

[https://indieauth.com/developers Read the full documentation]

The [https://github.com/aaronpk/IndieAuth.com IndieAuth.com source code] is available on GitHub.

== Server Implementations ==
<span id="Implementations"></span>
Software libraries and plugins which allow developers to add IndieAuth server functionality to their apps, and CMSes which provide a IndieAuth server by default.

* '''[https://github.com/barryf/acquiescence Acquiescence]''' is a simple IndieAuth authorization and token endpoint. It is currently limited to [[GitHub]] for authorization. {{barryf}} uses Acquiescence on his website.
* The '''[https://drupal.org/project/indieweb Drupal IndieWeb]''' module provides a self-contained IndieAuth server for Drupal
* The '''[[Wordpress IndieAuth Plugin]]''' provides a self-contained IndieAuth server for Wordpress
* '''[[dobrado]]''' provides a built-in IndieAuth server.
* '''[https://github.com/tsileo/microblog.pub Microblog.pub]''' implements IndieAuth endpoints (authorization and token endpoint) with U2F support and you can use your ActivityPub identity to login to other websites/app
* '''[[selfauth]]''' is a single-user authorization endpoint implemented in a single PHP file
** https://glitch.com/~befitting-price is a nodejs port of [[selfauth]] written for nodejs running on glitch.com
** [https://github.com/sebastiangreger/kirby3-selfauth kirby3-selfauth] is an authorization endpoint plugin (an adapted version of [[selfauth]]) for [[Kirby]]
* '''[https://glitch.com/~cellar-door cellar-door]''' is a nodejs implementation with tests and hcard support ([http://github.com/nilsnh/cellar-door Github project]).
* '''[https://github.com/taproot/indieauth taproot/indieauth]''' is a PHP library for quickly adding well-tested, flexible, extensible, templatable IndieAuth Server functionality to any PSR-7 compatible app
* '''[https://git.schmarty.net/schmarty/belding#user-content-belding Belding]''' is a self-hostable standalone PHP app built around taproot/indieauth that provides authentication, token, introspection, and metadata endpoints for a single user / site.
* '''[https://github.com/reiterate-app/authorio reiterate-app/authorio]''' is a Rails Engine (plug-in) that will enable IndieAuth authentication endpoint functionality for any Rails-based site.
** Install the gem into your Gemfile and follow the instructions in the README. The engine installs with minimal changes needed to your existing site.
** [https://rubygems.org/gems/authorio Authorio on RubyGems]
* '''[https://github.com/iamspruce/spruce-indieLogin spruce/indieLogin]''' is a NodeJs implementation of indieLogin.com which is intended for JavaScript Developers to implement RelMeAuth authentication functionality.
* '''[[indielib]]''' ([https://go.hacdias.com/indielib go.hacdias.com/indielib]) is a Go library that provides a toolkit to implement both Server and Client IndieAuth authentication.
* '''[https://owncast.online Owncast]''' uses IndieAuth as an optional way to authenticate themselves with live stream chat as of v0.0.12. [https://owncast.online]
* '''[[ProcessWire#ProcessWire_IndieAuth|IndieAuth for ProcessWire]]''' adds authorization endpoint and token endpoint functionality to your ProcessWire site.
* '''[https://github.com/capjamesg/jamesg-indieauth SnackAuth]''' is an IndieAuth authorization and token endpoint developed in Python.

Former or archived implementations:

* The '''[https://github.com/metbril/grav-plugin-indieauth IndieAuth Plugin for Grav]''' adds IndieAuth support to a Grav website.
* <del>'''[[indiecert]]'''</del> was an implementation of an IndieAuth server using [https://github.com/aaronpk/IndieAuth.com/issues/77 client certificates] for authentication.

== IndieAuth Clients ==
<span id="Supporting_Sites"></span>
<span id="Apps"></span>

IndieAuth clients (AKA IndieAuth consuming sites) are sites that let you login using your IndieAuth identity. In [[identity]] terms, a site that consumes an IndieAuth identity is a '''relying party''' (RP), and as a set they are relying parties (RPs).

There are a growing number of web sites that you can log in to using IndieAuth and gain additional functionality:

* '''[[Main Page|IndieWeb.org]]''' — this site! Signing-in with IndieAuth enables you to edit the wiki, and authenticates you for its subdomains also like:
** https://events.indieweb.org/
** https://etherpad.indieweb.org/

* '''[[social reader]]s''' typically use IndieAuth to sign in
** '''[[Monocle]]''' a [[reader]] which requires IndieAuth for sign-in
** '''[[unicyclic]]''' https://unicyclic.com is a reader that you can sign in to with IndieAuth.
** '''[[Together]]''' a [[reader]] which requires IndieAuth for sign-in
** '''[[IndiePass]]''' a [[reader]] for iOS, Android and desktop which requires IndieAuth for sign-in
** '''[https://github.com/capjamesg/cinnamon Cinnamon]''', a web-based Microsub reader.

* '''[[Micropub/Clients|Micropub clients]]''' (nearly all of them) use IndieAuth to sign in

* Some '''Webmention services''' provide features or a dashboard after logging in with IndieAuth
** '''[[Telegraph]]''' allows people to send [[Webmentions]] after logging in.
** https://webmention.io/ — shows a dashboard (https://webmention.io/dashboard) after logging in
** [https://github.com/capjamesg/webmention-receiver capjamesg/webmention-receiver]: A webmention receiver.

* A few '''[[PESOS]]''' services make you login with IndieAuth as part of their setup:
** '''[[OwnYourGram]]''' enables you to copy your Instagram photos to your website
** '''[[OwnYourSwarm]]''' OwnYourSwarm enables you to copy your Swarm checkins to your website

* '''personal sites''' often provide more features or show more information to IndieAuth loggedin users
** '''[https://dmitri.shuralyov.com dmitri.shuralyov.com]''' — signing-in with IndieAuth lets users interact with Dmitri's website: open issues, write comments, leave reactions, etc.

* '''test & validator sites''''
** https://indielogin.com/
** '''[https://toolbox.imoxia.com imoxia toolbox]''' — a web-app developed by {{omz13}} – to test various IndieWeb and related things (profile discovery, endpoint discovery, authorization server metadata discovery, etc.)

* '''wikis'''
** The only authentication method supported by https://breakfastand.coffee is IndieAuth.

* '''others'''
** '''[https://en.pronouns.page/account pronouns.page]''' supports login with IndieAuth
** '''[[indielib]]''' ([https://go.hacdias.com/indielib go.hacdias.com/indielib]) is a Go library that provides a toolkit to implement both Server and Client IndieAuth authentication.
* ...

== Client Libraries ==

* [https://www.npmjs.com/package/indieauth-authentication JavaScript]
* [https://www.npmjs.com/package/@resources/indieauth-client JavaScript: @resources/indieauth-client] - framework-independent functions & an example with Express
* [https://github.com/indieweb/indieauth-client-php PHP]
* [https://github.com/Inklings-io/laravel-indieauth-client Laravel]
* [https://docs.rs/indieweb/latest/indieweb/standards/indieauth/index.html Rust]
* [[Authl]]
* [https://github.com/hacdias/indieauth hacdias/indieauth] — [[Go]] library that provides a toolkit to implement both Server and Client IndieAuth authentication.
* ...

== IndieAuth Protocol ==

<p class="plainlinks" style="text-indent: 2em; font-style: italic;">This section is a high-level overview of the protocol. See '''[https://indieauth.spec.indieweb.org/ The IndieAuth Specification]''' for in-depth technical information</p>

A user should only have to communicate their own homepage URL to the website they are trying to log in to. This is the core idea of [[Web sign-in]]. This means a developer should in their turn be able to find everything they need on that one user supplied URL.

=== Discovery from the User's Homepage ===

<p class="plainlinks" style="text-indent: 2em; font-style: italic;">See '''[https://indieauth.spec.indieweb.org/#discovery IndieAuth Spec: Discovery]'''</p>

IndieAuth uses the <code>indieauth-metadata</code> link <code>rel</code> value to allow clients to discover the location of an IndieAuth Server Metadata endpoint from a user’s homepage, which they can then fetch to discover all information necessary for the rest of the IndieAuth flow.

A user can link to their metadata endpoint from the <code><head></code> of their homepage, add the correct <code>rel</code> value and be done.

    <link rel="indieauth-metadata" href="https://example.com/indieauth/metadata">

Previous versions of IndieAuth defined two separate [[rel-values|<code>rel</code> values]] for discovery of the authorization and token endpoints, which can be used for back-compat with older clients in addition to <code>indieauth-metadata</code>.

    <link rel="authorization_endpoint" href="https://example.com/auth">
    <link rel="token_endpoint" href="https://example.com/token">

=== The Authorization Endpoint ===

<p class="plainlinks" style="text-indent: 2em; font-style: italic;">See '''[[authorization-endpoint]]''' and '''[https://indieauth.spec.indieweb.org/#authorization-request IndieAuth Spec: Authorization Request]''' for implementation details.</p>

<p class="plainlinks" style="text-indent: 2em; font-style: italic;">See also: '''[[consent screen]]'''</p>

The authorization endpoint is a page where applications can send users to and asking them to identify themselves. Because the user defines their own endpoint on their homepage, this can be part of their own website or a completely separate service. This is how the user provides proof they really operate the homepage URL they provided.

An application can also ask the user to grant it certain rights by requesting them through the authorization endpoint. A [[Micropub]] client might ask to be allowed <code>create</code> rights. The user can then either accept these or not when they have been redirected to their endpoint.

For developers, the authorization endpoint also functions as a verification service. If they get a code from a user they can check its validity with the endpoint to make sure it was truly issued by the user.

=== The Token Endpoint ===

<p class="plainlinks" style="text-indent: 2em; font-style: italic;">See '''[[token-endpoint]]''' and '''[https://indieauth.spec.indieweb.org/#redeeming-the-authorization-code IndieAuth Spec: Redeeming the Authorization Code]''' for implementation details.</p>

The token endpoint is a service that creates access tokens for applications to store and use in [[Micropub]] requests. After authorizing the application, the token endpoint creates a token that the application stores. The application will send it in a header when making a Micropub request, and the Micropub endpoint is expected to be able to validate the token while processing the request.

== FAQ ==
The IndieAuth.com FAQ is here:
* https://indieauth.com/faq

Feel free to add more questions here that seemed to be asked more than once.

=== How is IndieAuth different from OpenID Connect? ===
{{main|How is IndieAuth different from OpenID Connect}}

=== Do I need a silo account? ===
No silo accounts are required for IndieAuth services, but some may chose to use them as an authentication method.

See also [[indieauth.com#Do_I_need_a_silo_account|the answer to this question on the IndieAuth.com page]].

=== Do I need to enter my URL every time? ===
Q: Do I need to enter my URL every time I log in to an app that uses IndieAuth?

Yes, like traditional username/password forms, you need to enter your URL when you log in to an app. Browsers will remember your URL you enter and will suggest it using their normal autofill mechanisms as well.

[[File:indieauth-autofill.jpg|300px]]

=== Can anyone supply the URL as the client ID when they make the request? ===

Yes, just like you can find someone's client ID and supply that in the request with public client in OAuth 2.0.

In OAuth 2.0 there is the idea of public vs. confidential clients, public clients are when things can't be kept secret, like native apps.

A secret already can't be used when it is deployed in native apps in traditional OAuth 2.0, so we're just taking the idea of public clients and doing all the protections that you would have to do with public clients and extending that to all clients.

=== Should I use HTTPS? ===

<span id="Security"></span>
<span id="Should_the_specification_make_recommendations_on_HTTPS.3F"></span>

The IndieAuth specification is an extension of OAuth 2.0, and [https://tools.ietf.org/html/rfc6749#section-10.5 OAuth 2.0 recommends using https URLs] for everything. IndieAuth doesn't provide any new reason to require or not require https so delegates this recommendation to OAuth 2.0.

=== Why do I see form-encoded responses? ===

<span id="IndieAuth_using_form-encoded_responses_instead_of_JSON"></span>

IndieAuth originally used standard form-encoding for requests and responses, since it has been a standard encoding format since the beginning of the web.

Over time, implementations added support for sending JSON responses as well as form-encoded. When IndieAuth was written up as a [https://www.w3.org/TR/indieauth/ formal OAuth 2.0 extension], it documented only the JSON responses in order to be compatible with OAuth 2.0. At that point, most implementations already supported JSON responses, or did content negotiation to support both formats.

=== How can an application get additional information about the user? ===

<span id="Requesting_additional_user_details"></span>

The IndieAuth specification offers the user’s profile page where further public information about the user can be found, e.g. by parsing an [[h-card]]. There is currently no common way of retrieving private information.

=== How is this any different than OpenID 1.0? ===

OpenID 1.0 solved a lot of the same problems as this, and then those problems kind of got push by the wayside when OpenID Connect came around.

With OpenID 1.0, the whole idea was bring your own identity. In fact, it was only the "prove the identity" aspect. It didn't include anything around OAuth which is about the ability to get something that can be used to access an API. OpenID 1.0 only solved half of that first of it all.

So yes, the original goals of OpenID 1 absolutely apply. OpenID Connect chose to ignore individual identity and instead, switched to where enterprises issue identities and everybody is siloed off and the issuer controls the identity.

=== Does this use Webfinger for discovery? ===

IndieAuth uses even less steps than Webfinger. Currently all IndieAuth applications a user enters their full URL which then fetchs HTTP and HTML link rels to find the appropriate endpoints.

If you wanted to have a user type in an email address to start out with, you would then need to use something like WebFinger to turn that into URL first.

We don't see a lot of that being done right now in the things that are running today.

=== If you have no pre-existing registration, how are you identifying yourself? ===

Clients are all identified by a URL. In the OAuth 2.0 world, the primary thing that client registration gives you is: it ensures that system exchanging the code is actually the same system the code was issued to.

When all clients are public clients, like JavaScript apps and mobile apps, you don't get a secret when you register, so you have to register a callback URL. The  URL basically acts as authentication already in the existing OAuth 2.0 world and OpenID Connect, what we've done with IndieAuth is said that client IDs don't need to be pre-registered because the only thing it gives you is a way to put that information about the app there.

So instead of pre-registration, registration is DNS. An application will be running at example.com, that's already an identifier that's unique in the system, that is used as the identifier, and if we need to find out information about the app we can go and look it up at that URL.

=== Where do I get user information from? ===

On that last step of the authentication flow, you get a reference to the user who's been identified. You can use this to extract a [[h-card]] that'll tell you everything that the user chooses to share publicly with you. This can include their name, e-mail, photo and a username that they'd prefer to use.

=== Why does IndieAuth require separate authorization and token endpoints? ===
It’s a design decision carried over from [https://oauth.net/ OAuth2]. The authorization endpoint is used when interacting with the user (i.e. it outputs HTML, deals with cookies and such), whereas the token endpoint is used by the application (i.e. it only responds to simple POST requests, and returns JSON).

In practice, the two endpoints will almost always be part of the same system, and be able to communicate and verify authorization codes in the same way as the authorization endpoint. Previous versions of the spec defined communication between separate auth and token endpoints, but [https://github.com/indieweb/indieauth/issues/44 were dropped due to confusion and lack of real-world use].

== Issues ==
For issues about the IndieAuth spec, please see the [https://github.com/indieweb/indieauth/issues IndieAuth GitHub project].

For issues with the IndieAuth.com service, please see the [https://github.com/aaronpk/IndieAuth.com/issues IndieAuth.com Github project].

<span id="naming_confusion"></span>
<span id="how_to_should_include_endpoint_definition"></span>
<span id="Need_Simple_Copy_Paste_How_To"></span>
<span id="To_do"></span>

Older discussions and brainstorming has been moved to [[IndieAuth-brainstorming]].

== Talks and Demos ==
* 2020-09-22 [https://aaronparecki.com/2020/09/22/25/activitypub-oauth-2-1 ActivityPub and OAuth 2.1] at ActivityPub Conference
* 2018-12-10 [https://www.youtube.com/watch?v=EeCNlB7v08I IndieAuth: OAuth for the Open Web] at the W3C Strong Authentication and Identity Workshop
* 2018-07 [https://twitter.com/OAuth_io/status/1023746803395514368 OAuth.io included IndieAuth in a presentation at API Days] in San Francisco
* 2016-09-24 Sebastian Lasse [https://indieweb.org/2016/Brighton/Demos#Sebastian_Lasse had a demo] showing the use of protocol handlers to keep the "me" in the browser ([https://www.youtube.com/watch?v=W70wd56i0Bg&t=34m1s video]) at [https://indieweb.org/2016/Brighton IWC Brighton]
* 2014-05-06: Aaron Parecki [http://indiewebcamp.com/2014-05-06-iiw-indieauth held a session] at [http://www.internetidentityworkshop.com/ Internet Identity Workshop XVIII]
* 2013-08-13: Aaron Parecki [http://aaronparecki.com/presentations/2013/08/08/1/indieweb-w3c-workshop-on-social-standards gave a talk on IndieAuth] at the W3C Workshop on Social Business
* 2012-06-24: Aaron Parecki [http://opensourcebridge.org/sessions/856 gave a talk on IndieAuth] at Portland's Open Source Bridge 2012 conference! Tuesday June 26th at 4:45pm

== Articles ==
* {{citation
| title = Creating a Personal IndieAuth Server
| url = https://www.jvt.me/posts/2020/12/09/personal-indieauth-server/
| author = {{jamietanna}}
| published = 2020-12-09
| archiveurl = http://web.archive.org/web/20220905022127/https://www.jvt.me/posts/2020/12/09/personal-indieauth-server/
}}
* {{citation
| title = How to Sign Users In with IndieAuth
| url = https://aaronparecki.com/2021/04/13/26/indieauth
| author = {{aaronpk}}
| published = 2020-04-13
| archiveurl = http://web.archive.org/web/20220905022438/https://aaronparecki.com/2021/04/13/26/indieauth
}}
* {{citation
| title = IndieAuth Spec Updates 2020
| url = https://aaronparecki.com/2020/12/03/1/indieauth-2020
| author = {{aaronpk}}
| published = 2020-12-03
| archiveurl = https://web.archive.org/web/20201206092226/https://aaronparecki.com/2020/12/03/1/indieauth-2020
}}
* {{citation
| title = Your Website Is Your Passport
| url = https://desmondrivet.com/2020/02/12/website-identity
| author = [https://desmondrivet.com Desmond Rivet]
| published = 2020-02-12
| archiveurl = http://web.archive.org/web/20220905022528/https://desmondrivet.com/2020/02/12/website-identity
}}
* {{citation
| title = Identity for the Decentralized Web with IndieAuth
| url = https://hacks.mozilla.org/2018/10/dweb-identity-for-the-decentralized-web-with-indieauth/
| author = {{aaronpk}}
| published = 2018-10-24
| archiveurl = http://web.archive.org/web/20181030031543/https://hacks.mozilla.org/2018/10/dweb-identity-for-the-decentralized-web-with-indieauth/
}}
* {{citation
| title = OAuth for the Open Web
| url = https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web
| author = {{aaronpk}}
| published = 2018-07-07
| archiveurl = http://web.archive.org/web/20180710220016/https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web
}}
* {{citation
| title = IndieAuth for Micro.blog
| url = https://manton.micro.blog/2018/07/02/indieauth-for-microblog.html
| author = {{manton}}
| published = 2018-07-02
| archiveurl = http://web.archive.org/web/20180717124757/https://manton.micro.blog/2018/07/02/indieauth-for-microblog.html
}}
* {{citation
| title = WebSub and IndieAuth Published on w3.org!
| url = https://aaronparecki.com/2018/01/23/34/w3c-websub-indieauth
| author = {{aaronpk}}
| published = 2018-01-23
| archiveurl = http://web.archive.org/web/20180125010525/https://aaronparecki.com/2018/01/23/34/w3c-websub-indieauth
}}
* {{citation
| title = IndieAuth
| url = https://www.oauth.com/oauth2-servers/indieauth/
| author = {{aaronpk}}
| published = 2016-08-30
| archiveurl = https://web.archive.org/web/20171026202106/https://www.oauth.com/oauth2-servers/indieauth/
}} and sub-chapters on OAuth.com:
** {{citation
| title = IndieAuth Sign-In Workflow
| url = https://www.oauth.com/oauth2-servers/indieauth/sign-in/
| author = {{aaronpk}}
| published = 2016-08-30
| archiveurl = https://web.archive.org/web/20171026202346/https://www.oauth.com/oauth2-servers/indieauth/sign-in/
}}
** {{citation
| title = IndieAuth Authorization Workflow
| url = https://www.oauth.com/oauth2-servers/indieauth/authorization/
| author = {{aaronpk}}
| published = 2016-08-30
| archiveurl = https://web.archive.org/web/20171026202415/https://www.oauth.com/oauth2-servers/indieauth/authorization/
}}

[[Category:building-blocks]]
[[Category:IndieAuth]]

== See Also ==
* [[IndieAuth-spec]]
* https://en.wikipedia.org/wiki/IndieAuth
* [[Web sign-in]]
* [[RelMeAuth]]
* [[sign-in-use-cases|Web Sign-In Use Cases]]
* [[IndieAuth-brainstorming|IndieAuth Brainstorming]]
* [https://indieweb.org/images/2/2f/indieAuthProp.svg An (unofficial) proposal for an IndieAuth logo]
* [[Zero Registration]]
* [[:Category:building-blocks]]
* [[:Category:IndieAuth]]
* [[login]]
* [[delegated sign-in]]
* [https://www.ietf.org/id/draft-ietf-oauth-security-topics-16.html OAuth 2.0 Security Best Current Practice] - not all applies, but good reading for implementers
* https://github.com/hawx/relme-auth
* Here until there's a [[password]] page: 2021-07-06 WIRED: [https://www.wired.com/story/passwords-not-dead-yet-authentication/ Why the Password Isn't Dead Quite Yet]
* Testimonial: https://twitter.com/brianleroux/status/1532798974955880448
** "IndieAuth is pretty slick. Feels very right to use my own domain as my identity. I spread the functionality over 8 or so cloud functions but none where more than 50 LOC. They'll scale forever up, and down. More than likely always within free tier. Pretty big upside over WP." [https://brian.io @brianleroux] June 3, 2022
* Relying Party: https://en.pronouns.page/
Return to IndieAuth.
Retrieved from "https://indieweb.org/IndieAuth"