# 9in documentation

> Hosted login, OAuth 2.1 and OpenID Connect for your apps: what 9in is, how it works and where to start.

Source: https://9in.io/docs/

9in signs your users in. Your app sends people to a sign-in page that 9in hosts on your domain; they sign in with a password, a one-time code, Google, their company's identity provider or a single-use login link; and your app gets standard OpenID Connect tokens back. Your API checks those tokens. That's the whole integration.

```text
Your app ──redirect──▶ https://acme.9in.io/oauth/authorize ──▶ hosted sign-in page
   ▲                                                                  │
   └────────── code ◀───────────── redirect back to your app ◀────────┘
   │
   └──▶ POST /oauth/token  →  ID token (who signed in) + access token (for your API)
```

Because 9in is a standard OpenID Connect provider (OAuth 2.1), **any certified OIDC library works**. The 9in SDKs make the common cases shorter.

## Start here

- [Quickstart](https://9in.io/docs/quickstart/): sign users in to a web app and call your API, in five minutes.
- [Concepts](https://9in.io/docs/concepts/): tenants, environments, applications, APIs and connections.
- [Build with AI](https://9in.io/docs/build-with-ai/): give your AI assistant everything it needs, in one link.

## Pick your app type

| You are building | Read | Flow |
|---|---|---|
| A React, Vue, Svelte or plain JS app | [Single-page apps](https://9in.io/docs/single-page-apps/) | Authorization code + PKCE in the browser |
| Next.js, Express, Rails, Django, any server | [Server-rendered apps](https://9in.io/docs/server-apps/) | Authorization code with a client secret |
| PHP or Laravel | [PHP and Laravel](https://9in.io/docs/php-laravel/) | Authorization code with a client secret |
| iOS, Android, React Native, Flutter, desktop | [Mobile and desktop apps](https://9in.io/docs/native-apps/) | Authorization code + PKCE in the system browser |
| A service, cron job or script | [Machine to machine](https://9in.io/docs/machine-to-machine/) | Client credentials |
| A TV app or a CLI | [TVs, CLIs and devices](https://9in.io/docs/devices/) | Device authorization (RFC 8628) |
| An API that receives tokens | [Protecting your API](https://9in.io/docs/protecting-apis/) | Verify JWTs or introspect |

## What else is in the box

- **Sign-in methods:** passwords, passwordless codes by email or SMS, authenticator-app two-factor, 14 social providers, enterprise SSO with any OIDC provider, and single-use login links.
- **Your users, your way:** users live in 9in, in [your own database](https://9in.io/docs/own-database/), or move over from Auth0, Firebase, Cognito, Supabase, Clerk, Keycloak or Okta with their passwords ([importing users](https://9in.io/docs/importing-users/)).
- **Your brand:** [themes](https://9in.io/docs/themes/) you edit by clicking the preview, every text in every language, [custom domains](https://9in.io/docs/custom-domains/) and branded [emails](https://9in.io/docs/emails-and-texts/).
- **Operations:** [webhooks](https://9in.io/docs/webhooks/), the [Management API](https://9in.io/docs/reference/management-api/), live token revocation, an activity log, and a sandbox for every tenant.

## Machine-readable docs

Every page is also plain Markdown (add `.md` to the URL, or use **Copy page as Markdown** at the top). [/llms.txt](https://9in.io/llms.txt) indexes all pages for language models, [/llms-full.txt](https://9in.io/llms-full.txt) has all of them in one file, [/openapi.json](https://9in.io/openapi.json) describes the Management API, and [/schemas/](https://9in.io/schemas/webhook-event.json) has JSON Schemas for webhooks, the adapter protocol and theme manifests.