Skip to content
Trustaige Docs

Before you go live with customer credentials

The checklist to run before real customers sign up. URIs, secrets, the subject column, resends, prompt=login, refusals, erasing, and HumanProof.

View as Markdown
Customer credentials

Run through this before real customers sign up.

  • Your redirect, post-logout and initiate login URIs are registered exactly, on HTTPS.
  • The client secret lives in your secret store, never in the browser or your repository.
  • subject is a unique column, and sign-in matches customers by it: it is the sub in every ID token and stays the same across renewals. A credential’s document number changes each time it renews, so don’t key on it. Your own fields, email included, are yours to search however you like.
  • Your welcome email carries the claim link, from your own domain.
  • Someone who signs up again before claiming gets a new link for the subject you already stored (send subject with the offer). Ask for a new subject only when the hub answers 404 unknown_subject; 409 already_claimed means they hold it already, so send them to sign in.
  • Sign-in sends prompt=login after a sign-out or a refusal.
  • Refusals show your own wording, never error_description.
  • Closing an account calls the erase endpoint, and treats 404 as done.
  • Your server verifies the HumanProof token before it saves a record or asks for a subject.