The options you can pass when sending someone to Human Pass, and what can come back.
Languages
Pass ui_locales (space-separated language tags, in order of preference) to show Human Pass's pages in your site's language. Discovery lists the languages available in ui_locales_supported. Without it, Human Pass uses the person's saved language, then their browser's.
oidc.buildAuthorizationUrl(config, { …, ui_locales: "fr en" })Errors
Errors come back to your redirect URI as error (and error_description) instead of code.
| error | When | What to do |
|---|---|---|
access_denied | The person cancelled, couldn't be verified, isn't allowed to sign in, or declined to share with your site. Human Pass never says which. | Show your signed-out page with a way to try again. |
invalid_request | Something's wrong with your request, for example no PKCE code_challenge. | Fix the request (see error_description). |
A redirect URI that isn't registered on the client isn't redirected to at all: Human Pass shows an error page instead, so codes never go to an unregistered address.
Sessions and tokens
| Lifetime | |
|---|---|
| Authorization code | 60 seconds, single use |
| ID token, access token | 10 minutes |
| Refresh token | None |
| Human Pass sign-in session | Up to 12 hours |
Start your own session after sign-in, as long as suits you. When it ends, send the person through sign-in again: within Human Pass's session it's immediate, without any prompts.
Signing out
Signing someone out of your site only needs your own session cleared. Their Human Pass session ends by itself within 12 hours.