Introduction
Usher is an identity provider: it signs people in to your apps, keeps their accounts safe, and tells your app who they are. It does all of this with OpenID Connect and OAuth 2.1, so it works with the libraries you already use.
What Usher does
An usher does two jobs at a door. They check your ticket, and they show you to your seat. Usher does the same two jobs for your app:
- Authentication. People prove who they are in the Lobby, Usher’s hosted sign-in page, with a passkey, an emailed code, a magic link, a social account or a password.
- Authorisation. Your app receives tokens that say who the person is and what they agreed to share, and your API can check them.
The pieces
| Piece | What it is |
|---|---|
| The Lobby | The hosted sign-in page. It always names the app the person is going to. |
| Usher account | What a person has: their email, passkeys, second factors and signed-in devices. |
| Usher Console | Where you create projects and environments, register applications and manage users. |
| SDK and components | @usher/nextjs, with <SignIn /> and <UserButton />. Coming with the SDK. |
How it fits into your app
Every environment you create is its own OpenID Connect issuer, at an address of its own:
Issuer
https://<handle>.id.hallelo.netYour app sends people to that issuer to sign in, and gets them back with a code it swaps for tokens. That is the standard authorisation code flow with PKCE, and every step of it is described by the issuer’s discovery document:
Discovery document
https://<handle>.id.hallelo.net/.well-known/openid-configuration