What auth.my is
A sign-in service you connect to your site instead of writing one yourself.
auth.my is an identity provider. Your site stops storing passwords, verifying email addresses and dealing with second factors: all of that happens on our side, and your site gets an answer to a single question — who just arrived.
It is plain OpenID Connect. No proprietary protocol, no mandatory SDK. Whatever you already use will work: Auth.js, passport, Spring Security, mozilla-django-oidc, anything else.
What your site does
Three steps, none of which you repeat:
- Register a client in the admin console — a name and a redirect URI.
- Point your library at one URL.
- Add a sign-in button.
https://auth.my/.well-known/openid-configuration
Your library takes everything else from there: endpoints, signing keys, algorithms. Details are in the quickstart.
What we handle
There are no passwords at all. Sign-in is by one-time code sent to email, by passkey, or through Google or Microsoft Entra. A password that does not exist cannot be stolen, guessed, or reused on another site.
Personal data is encrypted. Email addresses and phone numbers are stored encrypted; lookup works through a separate index that does not let anyone read the address back.
Users see what they granted. In their own console they see connected sites, last sign-in time, and can revoke access. After a revocation your tokens stop refreshing — treat that as "needs to sign in again", not as an outage.
What we do not have
Better said upfront than searched for:
- document verification (KYC/KYB);
- SAML — OpenID Connect only;
- separate sandbox and production environments: there is one environment;
- SCIM or automated user provisioning.
If one of these blocks your use case, tell us — it changes the order of work.
Next
- Concepts — client, identity, grant.
- Quickstart — a working example in ten minutes.
- Endpoint reference — if you are writing it by hand.