glf-account

One account, every project.

A person signs in once and is the same person to every Foundation project afterwards — one record in the database, however many ways they can prove it is them.

This page is the service itself, not a place to sign in. An application sends somebody to /authorize; what it gets back is a token every project can verify on its own, against the key published at /.well-known/jwks.json.

The doors on this machine

Door	State	Note
telegram	open	bot token from TELEGRAM_emmetbrown_bot_TOKEN
telegram_widget	open	@emmetbrown_bot; auth.genesis-lab.foundation must be registered with /setdomain
telegram_oidc	open	the only Telegram door that works on a laptop
google	open	web flow
google_native	open	audiences: 1
apple	closed	no Apple key — APPLE_SERVICES_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY
apple_native	closed	no APPLE_BUNDLE_ID
ton	open	no key needed — a wallet proves itself

What this process was given

Issuer: https://auth.genesis-lab.foundation
Store: mongodb · glf
Signing key: FzJtl7T5U_beLCOwaii-wlRWthFApv4eB-wpvhDUeuY
Which came from: environment

/health says the same thing as JSON, and says whether the database is answering. /playground walks a real sign-in against this service, which is the quickest way to find out whether a door works.