Active beta

pajID

Digital identity infrastructure built to disclose only what a service actually needs.

Scroll

Product surface

Login, consent, verification and tokens.

pajID combines passkey sign-in, scoped consent, verification levels and standards-based token issuance.

Passkey sign-in, scoped consent, RS256 tokens and verification levels.

Developer-facing routes, claims, Workers, D1 and R2 surfaces.

Protocol and features

Every layer of the OIDC stack is implemented to spec — not approximated.

RFC 7636 S256 code challenge required for all clients. No plain method. No implicit flow.

Asymmetric RSASSA-PKCS1-v1_5 signing with SHA-256. Public keys are published at JWKS for standards-compliant relying parties.

openid returns a stable sub only. Personal data — name, email, birthdate, photo — requires explicit user consent per scope.

ID0 through ID5 verification tiers. Age verification, document verification, and photo identity at appropriate levels.

Authentication flow

Applications can authenticate users or request specific verified claims — never more than the user consents to.

Any OIDC-compliant application can integrate. Discovery endpoint at /api/id/.well-known/openid-configuration.

Authenticate with full legal identity where jurisdiction requires it.

Request age_over_18 only — no name, no birthdate, no address shared.

Integration

OpenID Connect Discovery document: GET /api/id/.well-known/openid-configuration

Public key set for ID Token verification: GET /api/id/.well-known/jwks.json

Full developer documentation, client registration, and API reference.