Signing in to apps
Obsign identities don’t have a password. The keys that prove who you are live on your device, so there’s nothing for an app to check against a server. Instead, you approve each sign-in in the wallet: your device key does the proving, confirmed with Face ID or Touch ID, and no password is ever involved.
How it works
Section titled “How it works”When you sign in to an ATProtocol app with an Obsign identity, the app sends you to your server’s sign-in page. Instead of a password box, that page shows three ways to hand the request to your wallet:
- a short typed code,
- a QR code, and
- an Open in Obsign link (when the app is on the same phone as your wallet).
Bring the request into Obsign by any one of them. The wallet then shows you exactly what you’re about to approve:
- the app asking to sign in,
- the origin it’s running on,
- the identity you’d sign in as, and
- the permissions it’s requesting.
Check that preview, drop any permissions you don’t want to grant, and confirm with Face ID or Touch ID. That’s the sign-in. The app’s page notices the approval and finishes on its own.
Bring the request in three ways
Section titled “Bring the request in three ways”Typed code. Read the short code off the sign-in page and enter it in Obsign. This always works: no camera, no second device, and it reads cleanly for screen readers. It’s the fallback the other two fall back to.
QR code. Point the phone camera at the QR beside the code. Best when the app is on a different screen from your wallet — a laptop, say — because you can’t scan your own phone’s screen.
Open in Obsign. When the app and the wallet are on the same phone, tap the link and it opens Obsign straight to the approval. No typing, no scanning.
Or let the sign-in come to you
Section titled “Or let the sign-in come to you”If your server supports push notifications and you’ve allowed them, the wallet can also prompt you the moment a sign-in is requested for your account. Tapping the notification opens the same approval screen. On this path the sign-in page also shows a two-digit number, and the wallet asks you to type it before it will approve. That number is the proof you’re actually looking at the sign-in you’re approving, so a stray prompt can’t be granted with a reflexive tap.
Why this is safe
Section titled “Why this is safe”The QR, the handoff link, and the push notification carry only a request id — never the app name, origin, or permissions. Obsign takes that id and fetches the real details from your own server, then shows you those. A doctored QR can’t trick you into approving something other than what your server actually recorded: what you see in the preview is the source of truth, not what the code claimed.
A few more guarantees hold on every path:
- Your key approves, not a session. The confirmation is a signature from your device key, checked against your identity’s authoritative rotation keys, the same keys that anchor the identity itself. Approving a login is something only the holder of the identity can do.
- One use, then it’s spent. Each request works once and expires in about five minutes.
- No replay, no scope creep. The signature is bound to that specific request and to the exact set of permissions you granted. It can’t be replayed onto a different sign-in or a wider set of permissions.
- Approvals and denials are both recorded. If you deny a request, that ends it, and the decision is written to your identity’s audit trail either way.