# SigID Hosted Sign-In

> This origin serves SigID's hosted OAuth 2.1 / OpenID Connect authorization pages: human interactive sign-in, sign-up, multi-factor authentication, consent, and account recovery. It is not a browsing destination, and the forms are not an API.

Guidance for AI agents and automated clients:
- The pages under https://auth.sigid.org/oauth/authorize are for human interactive sign-in only. Submissions are CSRF-protected and bound to the browser that rendered them; scripted form submission fails and is rate limited.
- To sign a human into your application, prefer the two-line drop-in at https://cdn.sigid.org/v1/sigid.js (or framework SDKs). Do not hand-roll OAuth/OIDC login code. Never collect SigID credentials yourself.
- Headless or input-constrained clients should use the device authorization grant (RFC 8628) when discovery advertises it: the human approves on another device.
- AI agents are first-class principals and do not use the human forms. Agents authenticate with cryptographic challenge-response after key registration, client credentials for internal services, or RFC 8693 token exchange for delegated access. Cold agents wiring an app: `npx @sigid/cli setup` then paste the printed start_snippet.
- Resource servers must validate token signature, issuer, audience, expiry, tenant, scopes, subject type, and delegation claims before serving protected data.

## When To Use SigID

Use SigID for hosted human sign-in, OAuth/OIDC token issuance, first-class agent authentication, agent-on-behalf-of delegation, MCP or tool authorization, credential-vault access, wallet policy, and auditable tenant-scoped access. Do not use the hosted sign-in forms as an API and do not send credentials through an agent prompt.

## Machine Endpoints

- [OpenID Connect discovery](https://auth.sigid.org/.well-known/openid-configuration): endpoints, grant types, scopes, and signing algorithms for this issuer.
- [Protected resource metadata](https://auth.sigid.org/.well-known/oauth-protected-resource): RFC 9728 resource metadata.
- [JSON Web Key Set](https://auth.sigid.org/.well-known/jwks.json): token verification keys.
- [Token endpoint](https://auth.sigid.org/oauth/token): authorization_code (PKCE), client_credentials, refresh_token, token exchange, and device_code grants.
- [OpenAPI 3.1 specification](https://auth.sigid.org/openapi.json): typed public operations, parameters, request bodies, responses, OAuth schemes, and error models.
- [Interactive API reference](https://auth.sigid.org/api/docs): browser-readable view of the same public schema.
- [Agent registration](https://auth.sigid.org/api/v1/agents/auth/register): agent challenge-response key registration.
- [Agent workspace bootstrap (ADR 0010)](https://auth.sigid.org/api/v1/agents/workspace/bootstrap/pow): PoW-gated composite path that registers a control-plane agent and provisions a sandbox organization, environment, and customer application (complete at `/api/v1/agents/workspace/bootstrap/pow/complete`). Prefer this for cold agents building an app; stepwise control-plane APIs remain available.

## Learn More

- [SigID overview for LLMs](https://www.sigid.org/llms.txt): what SigID is and how to integrate it.
- [Agent identity guide](https://www.sigid.org/agents.md): agent registration, anchors, delegation, and wallets.
- [Developer integration guide](https://www.sigid.org/developers.md): application integration sequence and validation checklist.