Tokn · Sign-in

One account you can read, for any website.

Sign-in is an OpenID Connect provider kept in one Room. A site that does not exist cannot receive a code, a code cannot be redeemed twice, and every sign-in is a record with history. A second Room watches this one with a security reviewer that can add alerts and holds and never erase.

Your account

What is here

Demo site: a bookshop that offers "Sign in with Tokn". Clinic queue: a separate Room and app where you can take a token; signed in here, the token is kept in your name there.

Everything you do lands as a record. Sign in and your own record appears below.

Try to break it

Each line is something that must never happen. Each is refused by the Room, not by this page.

  1. A sign-in for a site nobody registered. The sign-ins table requires a site that exists, so the attempt cannot even be recorded against a fake one.
  2. A code redeemed twice. Redemptions are unique, so the second exchange is refused by the Room and no token comes back. On the demo site: sign in, then press "Replay the code".
  3. A sign-in erased after the fact. Rooms keeps history for every record and nobody, the owner included, can alter or erase it. Checked in the console, not from a page.
  4. The guard covering its tracks. Its writes were fixed at two tables, alerts and holds, when it was declared. Its reasoning for every run is on the Activities page.
  5. A hold lifted quietly. A lift is a new record that points at the hold. Both stay, with times.

For a website that wants "Sign in with Tokn"

Standard OpenID Connect, authorization code with PKCE. Discovery:

Ask the owner of this Room to add your site: a sites record with your client id, your exact redirect address, and whether you keep a secret.