SigID Hosted Auth

SigID Hosted Auth is the protocol origin for human authorization and machine authentication. It owns OAuth 2.1 and OpenID Connect authorization, consent, token issuance, revocation, introspection, dynamic client registration, device authorization, discovery, JSON Web Keys, agent challenge-response authentication, agent workspace bootstrap, and the public API description.

Human users arrive here only through an authorization request from a registered application. Automated clients must not scrape or submit hosted sign-in forms: those forms are CSRF-protected, transaction-bound, and rate limited. Agents and application backends should use discovery, the public OpenAPI schema, a SigID SDK, device authorization, client authentication, challenge-response, or delegated token exchange as appropriate.

Every protected resource must validate token signature, issuer, audience, expiry, tenant, scopes, subject type, and delegation claims. Request the smallest scope set needed for the current job. API failures use RFC 9457 Problem Details JSON so a machine can branch on stable fields instead of parsing an HTML error page.