Quickstart

Client-Side SDK npm install @loginwithone/sdk

Server-Side SDK npm install @loginwithone/node

SDKs currently available to private preview partners. Server-side SDKs also available for Rust, Golang, and Python.

1

Create a browser client

Use your public app ID and a registered redirect URL.

app.js

import { ONE } from "@loginwithone/sdk";

const one = new ONE({
  appId: "pk_test_123",
  redirectUri: `${window.location.origin}/auth/one`,
});

2

Request a proof

The browser receives one short-lived, signed proof.

verify.js

const proof = await one.verify({ age: "18+" });

await fetch("/api/one/verify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ proof }),
});

3

Verify on your server

Trust only the result returned by the server SDK.

server.js

import { verifyProof } from "@loginwithone/node";

const verification = await verifyProof(req.body.proof, {
  appId: process.env.ONE_APP_ID,
});

if (verification.proofs.age?.atLeast !== 18) {
  return res.status(403).json({ error: "age_required" });
}

res.json({ ok: true });

Request proofs

Ask only for the result your app needs.

age: "16+"

Confirms the user is at least 16.

age: "18+"

Confirms the user is at least 18.

personhood: true

Confirms the account belongs to a verified person.

Name, birth date, address, selfie, government ID, and email are never returned to the application.

Verify on your server

Node.js

const verification = await verifyProof(proof, {
  appId: process.env.ONE_APP_ID,
});

verifyProof() verifies the signature, signing key, issuer, audience, token type, expiry, app-specific subject, receipt, and proof shape.

Verification result

Verification

type Verification = {
  subject: string;
  proofs: {
    age?: {
      atLeast: 16 | 18;
      verifiedAt: string | null;
    };
    personhood?: {
      verified: true;
      verifiedAt: string | null;
    };
  };
  receipt: {
    id: string;
    issuedAt: string;
    expiresAt: string;
  };
};

Errors

access_denied

The user did not approve the request.

popup_closed

The verification window was closed.

proof_not_satisfied

ONE could not issue the requested proof.

proof_expired

The server received an expired proof.

SDK API

new ONE(options)

Creates a browser verification client.

one.verify(request)

Opens ONE and returns one opaque signed proof.

verifyProof(proof, options)

Verifies and normalizes the proof on a trusted server.

Security

Redirect URLs

Every redirect URL must be registered to your ONE app.

Authorization codes

Codes are app-bound, protected by PKCE, and invalid after one exchange.

Proofs

Proofs are short-lived and bound to your app’s audience.

Subjects

The same person receives a different subject identifier in every app.