Origin for developers

Give every person a safer way to arrive.

Add passkey-first authentication without absorbing someone’s identity into your application. Origin gives each connection its own private boundary while your product keeps control of its experience, profiles, roles, and permissions.

Explore the integration Talk to Origin

OAuth 2.0 · OpenID Connect · S256 PKCE

Identity boundary Protected
Sign-in
Passkey first
Subject
Unique to your app
Claims
Explicitly scoped

Less authentication to ownStandards-based sign-in and recovery

Identity stays separatedPairwise subjects for every application

Privacy is the defaultOnly registered claims cross the boundary

A clear path to production

From first conversation to trusted sign-in.

We help you choose the right client, scopes, and boundary for your product. Your team integrates against familiar standards and Origin handles the sensitive identity layer.

  1. 01

    Plan

    Tell us about your application

    Share your platform, exact redirect URI, sign-in experience, and the minimum identity claims your product needs.

  2. 02

    Connect

    Register the right client

    Origin supports confidential web, public native, constrained-input device, and service clients with policy appropriate to each one.

  3. 03

    Build

    Integrate with discovery and PKCE

    Read Origin’s provider metadata, begin authorization with state and nonce, then exchange the one-use code using its S256 verifier.

  4. 04

    Launch

    Verify the boundary

    Confirm redirect matching, token validation, scoped claims, sign-out behavior, and the experience people see before going live.

Designed for both sides

Shared trust without shared ownership.

Your application owns

The product relationship

  • Profiles and product presentation
  • Roles, permissions, and content
  • Application-specific lifecycle
  • The experience after sign-in

Origin protects

The identity relationship

  • Passkeys and account recovery
  • Pairwise application identities
  • Scoped claims and consent boundaries
  • Private Human Anchor information

Technical quick start

Build on standards, not custom authentication.

Production issuer

Discover Origin

Start with provider metadata

Use discovery instead of hard-coding individual endpoints. Origin publishes its issuer, supported grants, signing algorithms, public keys, and authorization capabilities in one document.

GEThttps://origin.anankeinc.com/.well-known/openid-configuration

Issuer: https://origin.anankeinc.com

Core endpoints

Authorize
/oauth/authorize
Token
/oauth/token
Revoke
/oauth/revoke
Device authorization
/oauth/device_authorization
Public keys
/.well-known/jwks.json

Secure by default

Protection begins with the first request.

Origin enforces the boundary at the protocol layer so your implementation starts from a safer baseline.

  • Exact redirect URI matching
  • S256 PKCE for authorization-code clients
  • Application-scoped subject identifiers
  • Rotating, one-use refresh-token families
  • No Human Anchor data in ordinary tokens
  • RS256-signed identity tokens

Build with Origin

Let’s design the right identity boundary for your app.

Tell us what you are building, who it serves, and where people need to sign in. We’ll help you map the integration and get started.

Email the Origin team hello@anankeinc.com