Sign in Start free

Get started

9in documentation

Hosted login, OAuth 2.1 and OpenID Connect for your apps: what 9in is, how it works and where to start.

View .md llms.txt

9in signs your users in. Your app sends people to a sign-in page that 9in hosts on your domain; they sign in with a password, a one-time code, Google, their company's identity provider or a single-use login link; and your app gets standard OpenID Connect tokens back. Your API checks those tokens. That's the whole integration.

Your app ──redirect──▶ https://acme.9in.io/oauth/authorize ──▶ hosted sign-in page
   ▲                                                                  │
   └────────── code ◀───────────── redirect back to your app ◀────────┘
   │
   └──▶ POST /oauth/token  →  ID token (who signed in) + access token (for your API)

Because 9in is a standard OpenID Connect provider (OAuth 2.1), any certified OIDC library works. The 9in SDKs make the common cases shorter.

#Start here

Quickstart: sign users in to a web app and call your API, in five minutes.
Concepts: tenants, environments, applications, APIs and connections.
Build with AI: give your AI assistant everything it needs, in one link.

#Pick your app type

You are building	Read	Flow
A React, Vue, Svelte or plain JS app	Single-page apps	Authorization code + PKCE in the browser
Next.js, Express, Rails, Django, any server	Server-rendered apps	Authorization code with a client secret
PHP or Laravel	PHP and Laravel	Authorization code with a client secret
iOS, Android, React Native, Flutter, desktop	Mobile and desktop apps	Authorization code + PKCE in the system browser
A service, cron job or script	Machine to machine	Client credentials
A TV app or a CLI	TVs, CLIs and devices	Device authorization (RFC 8628)
An API that receives tokens	Protecting your API	Verify JWTs or introspect

#What else is in the box

Sign-in methods: passwords, passwordless codes by email or SMS, authenticator-app two-factor, 14 social providers, enterprise SSO with any OIDC provider, and single-use login links.
Your users, your way: users live in 9in, in your own database, or move over from Auth0, Firebase, Cognito, Supabase, Clerk, Keycloak or Okta with their passwords (importing users).
Your brand: themes you edit by clicking the preview, every text in every language, custom domains and branded emails.
Operations: webhooks, the Management API, live token revocation, an activity log, and a sandbox for every tenant.

#Machine-readable docs

Every page is also plain Markdown (add .md to the URL, or use Copy page as Markdown at the top). /llms.txt indexes all pages for language models, /llms-full.txt has all of them in one file, /openapi.json describes the Management API, and /schemas/ has JSON Schemas for webhooks, the adapter protocol and theme manifests.

Get started

QuickstartAdd sign-in to a web app in five minutes with the JavaScript SDK, then call your API with the user's token.ConceptsTenants, environments, applications, APIs, scopes, connections and sessions, and how they fit together.Build with AIEverything an AI coding assistant needs to integrate 9in correctly: context files, specs and a prompt to start from.

Build your app

Single-page appsSign users in from React, Vue, Svelte or plain JavaScript with authorization code + PKCE, and call your API.Server-rendered appsSign users in from Next.js, Express, Hono or any back end with a confidential client and a server session.PHP and LaravelSign users in from PHP and Laravel with the 9in packages or any OpenID Connect client.Mobile and desktop appsSign users in from iOS, Android, React Native, Flutter and desktop apps with the system browser and PKCE.Machine to machineLet services and scripts call your API, or the Management API, with the client credentials grant.TVs, CLIs and devicesSign users in on devices without a keyboard or browser with the device authorization grant (RFC 8628).Protecting your APIDefine an API, request tokens for it and verify them: locally, with live revocation (hybrid) or by introspection.

Passwords, codes and two-factorPassword, passwordless one-time codes by email or SMS, authenticator-app two-factor and recovery codes.Social loginGoogle, GitHub, Microsoft, Apple and 10 more providers, with 9in's shared apps or your own.Enterprise SSOConnect your customers' identity providers (Microsoft Entra ID, Okta, Google Workspace, any OIDC provider) with email-domain routing.Login linksSingle-use sign-in URLs for magic links in your own emails, or to move a signed-in user from your app to 9in.Sessions and securitySession lifetime, single sign-on, sign-out, brute-force lockouts, bot protection and SMS fraud limits.

Users

Users and profilesThe user record, sign-up fields, custom profile fields and claims, name, password and username rules, verification and the account page.Your own user databaseKeep users in your database: 9in calls three signed endpoints to check passwords and look users up.Importing usersMove users from Auth0, Firebase, Cognito, Supabase, Clerk, Keycloak, Okta or your own database, with or without their passwords.WebhooksGet told when users sign up, change or sign in, and when sessions and tokens are revoked: signed, retried, deduplicated.Coming from SSOfyWhat changed from SSOfy and how to move an existing integration to 9in.

Branding

ThemesChange how the hosted pages look: theme options, languages and texts in the console, or your own Handlebars templates.Emails and textsThe emails and text messages 9in sends, how to change their wording per language, and the sender details.Custom domainsServe sign-in from your own domain, such as login.example.com, with automatic TLS.

Reference

OAuth and OIDC endpointsEvery endpoint of a tenant: discovery, authorize, token, userinfo, revoke, introspect, logout and device, with parameters and responses.Tokens and claimsAccess, ID and refresh tokens, their claims and lifetimes, scopes and the claims they add, signing keys and algorithms.Management APICreate, find, update, import, block and delete users, create login links and end sessions over HTTPS.JavaScript SDKEvery class, function and option of @9in-io/sdk and @9in-io/sdk/server.Webhook eventsEvery webhook event type, when it is sent, and the data it carries.Adapter protocolThe three signed endpoints your user database implements, with request and response formats and the signature scheme.Theme referencePages, partials, template variables, helpers, manifest.json options and security settings for custom themes.ErrorsError codes from the OAuth endpoints, the Management API, the hosted pages and the SDK, and what to do about each.Plans and limitsMonthly active users, what happens above a plan's limit, rate limits and the other numbers worth knowing.