Docs / Reference
Endpoints
Paths are relative to the issuer, which is https://usesigno.co.uk on the public signo. Libraries should read the OpenID Connect endpoints from discovery rather than hard-code them.
OpenID Connect
| Path |
What it is |
/.well-known/openid-configuration |
Discovery: the endpoints below and what signo supports |
/auth |
Authorization endpoint, where your site sends people to sign in |
/token |
Token endpoint, which exchanges a code for tokens |
/me |
Userinfo endpoint |
/jwks |
The public keys that verify ID tokens |
/session/end |
End-session endpoint, for signing out |
/request |
Pushed authorization requests (RFC 9126). oidc-provider enables it; signo's tests don't cover it yet |
For developers
| Path |
What it is |
/signo.js |
The browser library for single-page apps, as a JavaScript module any site may load |
For people
| Path |
What it is |
/account |
The account page: name, passkeys, sign out, delete the account |
/account/sites |
Add and manage sites |
/privacy |
What this copy stores and who receives it |
/trust |
Standards, practices and how to report a security problem |
For agents
| Path |
What it is |
/llms.txt |
An index of the docs, as Markdown |
/llms-full.txt |
All the docs in one file |
any page + .md |
That page as Markdown; /index.md for the home page |
/.well-known/security.txt |
The security contact, when the operator of the copy has set one |
Limits
| What |
Limit |
| Email links to one address |
5 per 15 minutes |
| Email links from one IP address |
30 per 15 minutes |
| Sign-in attempts from one IP address |
60 per 15 minutes |
| Token requests from one IP address |
600 per minute |