Skip to main content

Connecting your service

This page is the current Sign in with TridentGold integration. It does not verify a credential. For credential presentation, use the verifier guide.

What you need​

  • An HTTPS origin you control. client_id, redirect_uri, metadata, and JWKS must be on that same origin.
  • The published TypeScript SDK, installed from the private prerelease. Follow SDK installation after your onboarding contact grants repository access. Sign-in does not use the hosted issuer or the hosted verifier.
  • Testers with the assigned TridentGold iOS TestFlight app. The SDK does not include the wallet.

Same-device sign-in on iPhone is the path to use for a first integration.

Current SDK: create a request and handle the callback​

@human.tech/tridentgold-siop-rp exports createTridentGoldSiopRpClient(). Its backend API supports initiate(), processCallback(), and readTerminal(). The packaged examples/sign-in.ts shows their use with injected configuration, a request signer, and transaction storage.

Persist the initiating-browser binding on the server before returning a wallet launch URL. Forward the wallet callback to your backend, and create an application login session only when the outcome is authenticated. Handle cancellation, expiry, and failure without creating a login.

You supply:

  • RP configuration, including your clientId, redirectUri, metadata URL, and the wallet launch URL for the TridentGold app;
  • a durable transaction store whose pending-to-terminal transition is atomic;
  • a request signer that can keep private keys in your secret manager, KMS, or HSM.

Memory stores and local signers in the package are development-only examples.

This is SIOP account authentication. It does not verify a sandbox credential or bind a separate credential presentation to the authenticated account. There is no single exported signin() that performs both operations.

Use the authenticated result​

A successful result identifies the holder to your service only. Pairwise subjects are not meant to be reused as a cross-service citizen identifier.

Do not treat sign-in as proof of a qualification, age threshold, or other credential fact. If you also run a credential check, keep that result separate until your application explicitly associates them.

The wallet consent screen is origin-primary: it shows your HTTPS origin, not a registry-attested organization name or logo.

Attested display names, a supported cross-device path, and a combined login-and-presentation flow are later work, and none of them is in this sandbox.

Running sign-in on your site​

You operate the relying-party application. TridentGold does not host your login endpoints and does not sit in the wallet-to-you delivery path.

See Sign in with TridentGold for the roles in a sign-in, and What works today for what an invited partner can do today.