Coming from SSOfy
What changed from SSOfy and how to move an existing integration to 9in.
9in is SSOfy, rebuilt and relaunched on Cloudflare with standard OpenID Connect at its core. SSOfy's v1 endpoints and its signed API are not part of 9in, so an integration moves over rather than running unchanged. Most moves are small.
#What maps to what
| SSOfy | 9in |
|---|---|
https://<name>.ssofy.com | https://<name>.9in.io (or your custom domain) |
SSOfy SDKs (ssofy/*, @ssofy/*) | 9in SDKs: @9in-io/sdk, @9in-io/node, @9in-io/express-server, 9in/php-sdk, 9in/laravel. They read the old SSOFY_* environment variables when NINE_* ones are missing. Any OpenID Connect library works too. |
| API key + request signatures | The Management API with a client-credentials token |
auth/token (signing a user in from your app) | Login links |
| reCAPTCHA / hCaptcha / image captcha | Cloudflare Turnstile (bot protection) |
custom_1 … custom_9 | Custom profile fields with your own keys |
| Hybrid token validation | createTokenVerifier in hybrid mode (Protecting your API) |
#Your user database
Keep it. The adapter now has three endpoints instead of eight: /authenticate, /user and /event (Your own user database). Applications, scopes, social login and one-time-code options are configured in 9in instead of being served from your server. Requests and responses are signed with 9in-signature (HMAC-SHA256), and the SDK handlers do it for you.
#Themes
SSOfy Handlebars themes import as they are: layout, page partials, manifest.json and translations (Themes → Import theme). 9in renders them with the same component and partial names; pages a theme doesn't include (such as the newer two-factor pages) come from the default theme. Inline scripts need nonce="{{ csp_nonce }}", or allowInlineScripts in the manifest's security section for themes ported as they are. See the theme reference.
#Users
Import them with their password hashes and their ids, so sub doesn't change (Importing users), or let them move over as they sign in, through the adapter with Import users on first login.
#Step by step
- Create a tenant and recreate your applications (callback and logout URLs) and APIs.
- Configure sign-in methods, social providers, branding and your theme.
- Move users: import them, or connect your database.
- Switch your apps to the 9in SDK for your stack (or an OIDC library) and the new issuer.
- Replace SSOfy API calls with the Management API, and
auth/tokenwith login links. - Test everything in the sandbox, then go live.