ONEVAULT FOR DEVELOPERS

Less account setup.
More time for your product.

Let people bring their OneVault identity to your website or app. Ask for the information you need, explain why, and leave credentials with OneVault.

Explore the integration Developer access →

Apply from your OneVault account. Each organization and app is reviewed before it can sign people in.

ONE CONNECTION. CLEAR RESPONSIBILITIES.

Your application

Start a secure redirect to OneVault.

OneVault sign-in

The person authenticates and approves requested information.

Back to your product

Validate the response and create your own application session.

Your application never receives the person's OneVault password.

FROM BUTTON TO SIGNED IN

One redirect.
Verified claims back.

Your app sends people to OneVault. OneVault handles sign-in and consent, then your server swaps a one-time code for tokens and checks the ID token. The person never types a password into your app.

Your app
Redirect to OneVault with state, nonce and a PKCE S256 challenge.
OneVault
The person signs in with a passkey or password and approves the information you asked for.
Your server
Exchange the authorization code and code_verifier for tokens, then validate the ID token.
Verified claims
- sub pairwise ID
- name
- email_verified true
- phone_number_verified true
- onevault_country
Your app creates its own session and keeps its own roles.

Claims depend on the scopes the person approves. Phone claims appear only while OneVault holds a current verification of that number.

BUILT ON OPEN STANDARDS

A familiar protocol.
A considered experience.

OneVault uses OpenID Connect with the authorization code flow and PKCE. Approved developers find their client settings and step-by-step integration guides in their OneVault account.

Register an application

Describe your product, ownership, privacy contact, requested information, and exact return URLs. Keep testing and production separate.

Use a maintained OIDC library

Validate issuer, audience, signature, expiry, state, and nonce. Identify the person by issuer and subject, never by matching email addresses.

Request only what you need

Explain the purpose of each profile item. A verified email indicates control of an inbox; it does not establish a person's legal identity.

Keep credentials private

Server applications protect their credentials on the server. Browser and mobile applications cannot safely hold a client secret.

Manage your connection

Use the developer section inside your OneVault account to register apps, follow authenticity reviews, manage server credentials and inspect each application's audit history.

Prepare for revocation

Respect withdrawn access and security events. Your application remains responsible for its sessions, roles, retained data, and deletion requests.

LESS TO BUILD

Skip the account plumbing.
Keep your product logic.

OneVault takes care of the account work below, so your team can spend its time on what makes your product different.

Handled by OneVault

Sign-up forms and username rules
Email verification codes
Password storage and resets
Passkeys and new-device email codes
Phone verification, where offered
Sign-up abuse protection

What your app adds

GET /authorize?response_type=code
  &scope=openid email
  &code_challenge_method=S256

A maintained OpenID Connect library, one button, and your own roles, permissions and sessions.

TRUST & CONTROL

Good for your product.
Clear for your users.

Authentication stays separate from permission

OneVault establishes who signed in. Your application decides which organizations, records, payments, and features they may access.

Oversight continues after approval

Production access requires review. Misleading consent, suspicious redirects, credential leaks, and abuse can lead to restrictions or suspension.

Connections remain a choice

People should be able to review shared information and stop future access. Disconnecting does not automatically erase data already held by your application.

BRAND & SIGN-IN BUTTON

Every app that offers OneVault sign-in uses the same OneVault green button with silver text, so people know exactly where they are going. Show one button with the label Sign in with OneVault and use the files unmodified. People without a OneVault ID create one on the OneVault sign-in page and return to your app.

Download the full-colour mark, silver mark and button styles. Use of the OneVault marks is covered by section 13 of the Developer Terms.

DEVELOPER ACCESS

Start with your account.
Build with reviewed access.

Apply as an individual or a company from your normal OneVault account. A separate developer login is not needed.

Describe your work

Provide your identity or company details, website, role and intended use so the review team can understand who is building the integration.

Verify your contacts

Verify your official email with a one-time code. Provide accurate contact details and at least one official social profile to support your application.

Complete authenticity review

Contact verification does not automatically approve developer access. Staff review your application before the developer workspace becomes available.

Register each application

Approved developers can manage multiple apps. Each app has its own review, return URLs, authorization settings and credential lifecycle. Provider activation is shown separately from approval.

Open developer access Sign in to OneVault

An app goes live only after OneVault approves it and activates its client. Developer access is subject to the Developer Terms and Acceptable Use Policy.

A LITTLE MORE DETAIL

Before you integrate.

Can every developer start using OneVault today?

Apply through Developer access in your OneVault account. Complete email verification and wait for your application decision. Each app you register is reviewed separately before it goes live.

Will OneVault replace my application's accounts?

It replaces a repeated sign-in mechanism. You still keep an application account linked to the validated issuer and subject, plus your own permissions and business records.

Can I request access to every OneVault user?

No. An integration receives only approved information for the person who authorizes that connection. Developer access is not directory access.

What happens if my application is suspended?

OneVault disables the affected app, which stops new sign-ins and token issuance. Already issued tokens and application sessions require explicit expiry or revocation handling; suspension cannot recall data already shared.

Less account setup.More time for your product.