Sign in with Corenexis

One integration.
Every way to sign in.

Add Corenexis to your app and your users get Google, GitHub, Microsoft, Facebook, magic-link and password sign-in — with two-factor authentication, a consent screen and device management already built in. You wire up one OAuth 2.0 flow. We handle the identity.

Create an app Read the docs

Free · no SDK to install · plain HTTP and JSON

Google GitHub Microsoft Facebook Magic link Password 2FA
auth/callback.js 
// 1. send the user to Corenexis
res.redirect('https://accounts.corenexis.com/' +
  '?redirect=' + encodeURIComponent(CALLBACK) +
  '&state=' + state);

// 2. they come back with ?code=…
const tok = await (await fetch(BASE + '/api/token', {
  method: 'POST',
  body: new URLSearchParams({
    grant_type:    'authorization_code',
    code:          req.query.code,
    client_id:     CLIENT_ID,
    client_secret: CLIENT_SECRET,
  }),
})).json();

// 3. that's it — a verified user
req.session.userId = tok.user.id;
Lighter apps

Delete half your auth code

Authentication is the part of an app that is easy to start and expensive to finish. Everything on the left stops being your problem the day you integrate.

You no longer build

Or maintain, or get audited on.

  • Password hashing, strength rules and rotation
  • Reset-password and verify-email mail flows
  • TOTP two-factor, QR enrolment and backup codes
  • A separate OAuth app per social provider
  • Session storage, device lists and remote sign-out
  • Bot defence and captcha on your sign-in form
  • Credential-breach handling and lockout policy

You write instead

One redirect, one POST, one session.

  • A link that sends the user to Corenexis
  • A callback route that receives a code
  • One server-side POST that exchanges it for tokens
  • Your own session, keyed on the returned account id

No SDK, no library, no lock-in — it is standard OAuth 2.0 authorization code, so anything that already speaks OAuth speaks to us.

How it works

Three steps, and you are done

The browser never sees a secret. Your server does the one exchange that matters.

1

Redirect

Send the browser to accounts.corenexis.com/?redirect=… with your callback URL and a state you generated.

2

Get a code

The user signs in however they like, approves your app once, and comes back to your callback with a single-use code that lives 60 seconds.

3

Exchange it

Your server POSTs the code with your client_secret and gets an access token, a rotating refresh token and the user's verified profile.

See it

This is what your users will see

One button in your app, our sign-in screen, and a verified identity back on your server. Play it through — the third panel is the real shape of the response.

yourapp.com/login

Sign in to YourApp

Welcome back — pick how you'd like to continue.

One button. That is the whole integration on your side.

accounts.corenexis.com/consent

Sign in to YourApp

using your Corenexis Account

  • Your account ID
  • Your name and profile picture
  • Your email address
Cancel Continue

Shown once per user. Your privacy policy and terms appear here too.

POST /api/token — your server

Signed in as Aarav — your app never saw a password.

Build your app
Button kit

Take the screen, not just the idea

The button in that first panel is not a mockup — it is the markup below. Copy it, point the link at your authorize URL, and your sign-in screen is done. The mark is served from our servers, so it stays current without you re-exporting anything. 

<!-- Sign in with Corenexis -->
<a class="cnx-signin"
   href="https://accounts.corenexis.com/?redirect=https%3A%2F%2Fyourapp.com%2Fauth%2Fcallback&amp;state=YOUR_STATE">
  <img src="https://accounts.corenexis.com/assets/logo/icon-white-theme.webp"
       alt="" width="20" height="20">
  <span>Continue with Corenexis</span>
</a>

<style>
.cnx-signin{display:inline-flex;align-items:center;justify-content:center;gap:10px;
  padding:12px 22px;border:1px solid #dfe3ec;border-radius:10px;background:#fff;
  color:#131a35;font-family:inherit;font-size:.95rem;font-weight:600;line-height:1.2;
  text-decoration:none;cursor:pointer;
  transition:border-color .18s ease,box-shadow .18s ease}
.cnx-signin:hover{border-color:#fe5940;box-shadow:0 6px 18px rgba(254,89,64,.18)}
.cnx-signin:focus-visible{outline:2px solid #fe5940;outline-offset:2px}
.cnx-signin img{width:20px;height:20px}
</style>

Mark files, free to hotlink: accounts.corenexis.com/assets/logo/icon-white-theme.webp for light surfaces, icon-dark-theme.webp for dark. A .png of each sits beside it. Keep the wording “Continue with Corenexis” or “Sign in with Corenexis”, and please don't recolour or stretch the mark.

Included

Security you would otherwise schedule for later

Every item here is live on the platform today, for every app, with nothing to switch on.

Five ways in, one account

Google, GitHub, Microsoft, Facebook, magic link and password all resolve to the same Corenexis account — so a user who signed up with a password can later use Google and still be the same person to you.

Two-factor, done properly

TOTP with backup codes, replay-protected per RFC 6238 — a code cannot be reused inside its own window. Your app inherits it without a line of code.

Signed RS256 tokens

Access tokens are RS256 JWTs with a published JWKS and an OpenID discovery document, so your API can verify them without calling us.

Refresh rotation + reuse detection

Every refresh returns a new token and retires the old one. Presenting a retired token revokes the session instead of issuing more — RFC 9700 §4.14.2.

PKCE for native apps

S256 code challenges are supported and opt-in, which is what makes a custom-scheme callback on Android or iOS safe.

Consent and revocation

Users approve your app once, see exactly what it receives, and can withdraw access at any time from their Connected apps page — with no support ticket for you.

Anywhere

Web, mobile, desktop, API

If it can make an HTTPS request and keep one secret on a server, it can sign users in with Corenexis.

Server-rendered webPHP, Node, Python, Go, Rails — a redirect and a POST.
SPA + backendReact, Vue, Svelte with a thin API that holds the secret.
Android & iOSCustom-scheme callback, PKCE, exchange through your backend.
DesktopA loopback listener on 127.0.0.1 is accepted as a callback.
Data

You receive what the user agreed to. Nothing else.

Permissions are fixed server-side per app, so a request cannot widen them and a user is never shown a permission your app would not actually get.

DataFieldsNew apps
Account IDidAlways
Name & photoname, avatar_urlIncluded
Emailemail, email_verifiedIncluded
Country & timezonecountry, timezoneIncluded
Phone numberphone_country_code, phone_numberOn request
Security statustotp_enabled, created_atOn request

You never receive a password, a 2FA code or a backup code — nothing we send can be used to sign in as that user anywhere else.

Questions

Before you start

What does it cost?

Nothing. You can register up to five apps per Corenexis account, and each one gets the full flow — tokens, refresh, userinfo, consent, 2FA. If you need more than five, ask us.

Where do I create and manage an app?

On the identity platform itself: accounts.corenexis.com/developer. Apps are only ever created there — this site is the documentation. You need a Corenexis account with a verified email.

Do my users need an existing Corenexis account?

No. If they don't have one they can create it during the sign-in flow, or come in through Google, GitHub, Microsoft or Facebook — which creates the account for them.

Is this OpenID Connect?

It is OAuth 2.0 authorization code with OIDC-style pieces: RS256 ID-style access tokens, a JWKS endpoint and a discovery document. Any OAuth 2.0 client library will work; you don't need an OIDC-certified one.

Can I use it for a mobile app?

Yes — register a custom scheme such as com.yourapp.name://auth/callback, use PKCE, and exchange the code through your own backend so the client secret never ships inside the app. Full walkthrough in the docs.

What happens if a user revokes my app?

Its refresh tokens stop working immediately and the next refresh returns invalid_grant. Send the user through sign-in again; if they approve, you're reconnected.

Ship the app. We'll hold the identity.

Create an app, copy two values into your environment, and have working sign-in this afternoon — with 2FA and social providers your users already trust.

Create an app Integration guide
For your users

One account. Every app. Free.

Your users sign in once and carry the same verified identity into every app built on Corenexis — and they can see, review and revoke every one of them from a single place.

  • Free, all of itEvery provider, 2FA, consent and device management — no tier, no per-user pricing.
  • Secure by defaultTwo-factor on every method, one-time codes, and a password your app never sees.
  • Managed in one placeEvery connected app and signed-in device, reviewable and revocable at any time.

Stay in the Loop

Get the latest updates delivered straight to your inbox

Already subscribed? Manage preferences