Going live

Before real people sign in, work through this page. Most of it is a few minutes in the dashboard.

#Verify your domain

Production redirect URIs must be on a domain you've proven you control, so nobody can register a client that sends codes to your site's users. In the production dashboard, under Domains, add your domain and publish either a DNS TXT record or a small file at /.well-known/humanpass-verify. Subdomains are covered.

#Create a production client

Production is separate from the sandbox: create your project and client again in the production dashboard, with your https redirect URI, and change your settings to the production issuer, https://id.humanpass.co, and the new client ID and secret. IDs in production are different from the sandbox's.

#Integration checklist

• PKCE, state and nonce on every request (any good library does this).
• Accounts keyed on sub, never on anything else; previous_sub handled (rotations).
• access_denied shows your normal signed-out page.
• A daily status check of every ID you hold, acting on each status.
• The rotation drill passed in the sandbox.
• The client secret only on your server (environment or secret manager), never in a browser or app.
• Mobile and single-page apps use a public client (no secret, PKCE only), or go through your server.
• ui_locales passed if your site isn't in English (languages).
• Billing set up in the dashboard, if your plan has fees.

#Tell your users

• Say in your privacy policy that you use Human Pass, and what you receive from it: an ID for your site, that the person is a verified unique person, and any optional attributes you ask for.
• Your organization agrees to the developer terms and data processing agreement when it creates its dashboard account.