# 9in > Hosted login, OAuth 2.1 and OpenID Connect for every app, with social and enterprise sign-in, your own user database, custom domains and themes. 9in is a hosted login service and OpenID Connect provider (OAuth 2.1) running on Cloudflare. Apps redirect users to a hosted sign-in page on the tenant's domain and get standard tokens back, so any certified OpenID Connect library works; the 9in SDKs make it shorter. Facts to get right when integrating: - Each tenant has an issuer: https://.9in.io (production), https://-sandbox.9in.io (sandbox: any password works, one-time codes are 000000), or a custom domain such as https://login.example.com. Everything is discoverable at /.well-known/openid-configuration. - Browser and mobile apps are public clients: authorization code + PKCE (S256) only, no client secret. Server apps are confidential clients. Services use client_credentials with an API audience. - Access tokens are JWTs (typ at+jwt, RFC 9068) for the API named by the `audience` parameter, or opaque (9in_at_…) when configured; verify them with @9in-io/sdk/server (verifyAccessToken or createTokenVerifier) or any JWT library against /.well-known/jwks.json, checking iss, aud, exp and the token's own alg. - The Management API lives on the tenant host at /api/v1 and takes a client_credentials token with management:* scopes. - Webhooks and the adapter protocol are signed with the header 9in-signature: t=,v1=. ## Get started - [9in documentation](https://9in.io/docs/index.md): Hosted login, OAuth 2.1 and OpenID Connect for your apps: what 9in is, how it works and where to start. - [Quickstart](https://9in.io/docs/quickstart.md): Add sign-in to a web app in five minutes with the JavaScript SDK, then call your API with the user's token. - [Concepts](https://9in.io/docs/concepts.md): Tenants, environments, applications, APIs, scopes, connections and sessions, and how they fit together. - [Build with AI](https://9in.io/docs/build-with-ai.md): Everything an AI coding assistant needs to integrate 9in correctly: context files, specs and a prompt to start from. ## Build your app - [Single-page apps](https://9in.io/docs/single-page-apps.md): Sign users in from React, Vue, Svelte or plain JavaScript with authorization code + PKCE, and call your API. - [Server-rendered apps](https://9in.io/docs/server-apps.md): Sign users in from Next.js, Express, Hono or any back end with a confidential client and a server session. - [PHP and Laravel](https://9in.io/docs/php-laravel.md): Sign users in from PHP and Laravel with the 9in packages or any OpenID Connect client. - [Mobile and desktop apps](https://9in.io/docs/native-apps.md): Sign users in from iOS, Android, React Native, Flutter and desktop apps with the system browser and PKCE. - [Machine to machine](https://9in.io/docs/machine-to-machine.md): Let services and scripts call your API, or the Management API, with the client credentials grant. - [TVs, CLIs and devices](https://9in.io/docs/devices.md): Sign users in on devices without a keyboard or browser with the device authorization grant (RFC 8628). - [Protecting your API](https://9in.io/docs/protecting-apis.md): Define an API, request tokens for it and verify them: locally, with live revocation (hybrid) or by introspection. ## Sign-in - [Passwords, codes and two-factor](https://9in.io/docs/sign-in-methods.md): Password, passwordless one-time codes by email or SMS, authenticator-app two-factor and recovery codes. - [Social login](https://9in.io/docs/social-login.md): Google, GitHub, Microsoft, Apple and 10 more providers, with 9in's shared apps or your own. - [Enterprise SSO](https://9in.io/docs/enterprise-sso.md): Connect your customers' identity providers (Microsoft Entra ID, Okta, Google Workspace, any OIDC provider) with email-domain routing. - [Login links](https://9in.io/docs/login-links.md): Single-use sign-in URLs for magic links in your own emails, or to move a signed-in user from your app to 9in. - [Sessions and security](https://9in.io/docs/security.md): Session lifetime, single sign-on, sign-out, brute-force lockouts, bot protection and SMS fraud limits. ## Users - [Users and profiles](https://9in.io/docs/users.md): The user record, sign-up fields, custom profile fields and claims, name, password and username rules, verification and the account page. - [Your own user database](https://9in.io/docs/own-database.md): Keep users in your database: 9in calls three signed endpoints to check passwords and look users up. - [Importing users](https://9in.io/docs/importing-users.md): Move users from Auth0, Firebase, Cognito, Supabase, Clerk, Keycloak, Okta or your own database, with or without their passwords. - [Webhooks](https://9in.io/docs/webhooks.md): Get told when users sign up, change or sign in, and when sessions and tokens are revoked: signed, retried, deduplicated. - [Coming from SSOfy](https://9in.io/docs/coming-from-ssofy.md): What changed from SSOfy and how to move an existing integration to 9in. ## Branding - [Themes](https://9in.io/docs/themes.md): Change how the hosted pages look: theme options, languages and texts in the console, or your own Handlebars templates. - [Emails and texts](https://9in.io/docs/emails-and-texts.md): The emails and text messages 9in sends, how to change their wording per language, and the sender details. - [Custom domains](https://9in.io/docs/custom-domains.md): Serve sign-in from your own domain, such as login.example.com, with automatic TLS. ## Reference - [OAuth and OIDC endpoints](https://9in.io/docs/reference/endpoints.md): Every endpoint of a tenant: discovery, authorize, token, userinfo, revoke, introspect, logout and device, with parameters and responses. - [Tokens and claims](https://9in.io/docs/reference/tokens.md): Access, ID and refresh tokens, their claims and lifetimes, scopes and the claims they add, signing keys and algorithms. - [Management API](https://9in.io/docs/reference/management-api.md): Create, find, update, import, block and delete users, create login links and end sessions over HTTPS. - [JavaScript SDK](https://9in.io/docs/reference/sdk.md): Every class, function and option of @9in-io/sdk and @9in-io/sdk/server. - [Webhook events](https://9in.io/docs/reference/webhook-events.md): Every webhook event type, when it is sent, and the data it carries. - [Adapter protocol](https://9in.io/docs/reference/adapter-protocol.md): The three signed endpoints your user database implements, with request and response formats and the signature scheme. - [Theme reference](https://9in.io/docs/reference/themes.md): Pages, partials, template variables, helpers, manifest.json options and security settings for custom themes. - [Errors](https://9in.io/docs/reference/errors.md): Error codes from the OAuth endpoints, the Management API, the hosted pages and the SDK, and what to do about each. - [Plans and limits](https://9in.io/docs/reference/limits.md): Monthly active users, what happens above a plan's limit, rate limits and the other numbers worth knowing. ## Specifications - [Management API (OpenAPI 3.1)](https://9in.io/openapi.json): Users, imports, login links and sessions: every endpoint, parameter, response and error. - [Webhook event (JSON Schema)](https://9in.io/schemas/webhook-event.json): The body of every webhook request. - [Adapter user (JSON Schema)](https://9in.io/schemas/adapter-user.json): The user object an adapter returns. - [Adapter /authenticate request (JSON Schema)](https://9in.io/schemas/adapter-authenticate-request.json): Password check request. - [Adapter /user request (JSON Schema)](https://9in.io/schemas/adapter-user-request.json): User lookup request. - [Adapter event (JSON Schema)](https://9in.io/schemas/adapter-event.json): Notifications sent to an adapter. - [Theme manifest (JSON Schema)](https://9in.io/schemas/theme-manifest.json): manifest.json of a custom theme. ## Optional - [All documentation in one file](https://9in.io/llms-full.txt): every page above, in Markdown.