Sign in with Trustaige

Add passkey sign-in for your organization's people to any app with standard OpenID Connect or SAML. No passwords to store, reset or leak.

Trustaige is an OpenID Connect provider and a SAML identity provider. Your app sends people to Trustaige; they sign in with a passkey; your app gets back a signed statement of who they are. Any OIDC or SAML library works.

How it fits together

Your organization registers your app in the hub and assigns the people and groups who may use it.
Your app discovers everything it needs from the issuer’s discovery document, then runs the authorization code flow with PKCE.
The ID token names the person (sub, stable and opaque, per organization) and, when you ask, their email and groups.

curl https://id.trustaige.com/.well-known/openid-configuration

What the platform supports


Flow	Authorization code with PKCE
Client authentication	`private_key_jwt` (preferred: no shared secret exists), `client_secret_basic`, `client_secret_post`, or none for public clients
ID token signing	EdDSA by default; RS256, ES256 or PS256 when your app registers one
Subject identifiers	Public or pairwise
Assurance (`acr_values`)	`aal1`, `aal2`, `aal3`, `phr` (phishing-resistant), `phrh` (phishing-resistant, hardware-bound key)

Coming in this guide

Quickstarts for Node, Go, Next.js, Python and .NET; a SAML service provider; app roles and groups; step-up with acr_values and max_age; logout; apps shared with other organizations through Collab+; and how device trust and access policies affect sign-in.