Skip to content
Trustaige Docs
Customer credentials

Customer credentials

Customer credentials

Sign your customers up and in without passwords. You issue a credential, the customer claims it once, and every sign-in after is standard OpenID Connect.

Sign-up, sign-in, recovery and revocation are the credential’s job. You build the service. Names and addresses never leave your database.

The flow

  1. Prove a person is present with HumanProof on your sign-up form.
  2. Get a client token for your app with the offers:write scope.
  3. Ask for a claim link: POST /o/{shortId}/api/credentials/offers returns the new customer’s subject (store it with their account) and a claimUrl that claims their credential.
  4. Send the link yourself, by email or however you reach your customers.
  5. The customer claims it. From then on they sign in to your app with a standard OIDC flow against your organization’s issuer.

Afterwards

Read what you issued with GET /o/{shortId}/api/credentials/subjects (scope issued:read), and when a customer leaves, erase them with DELETE /o/{shortId}/api/credentials/subjects/{subject} (scope issued:manage).

A customer’s tokens carry a credential claim instead of an email or name. Its document_number changes on every renewal, so key your accounts on the token’s iss and sub.