# Endpoints

Paths are relative to the issuer, which is `https://usesigno.co.uk` on the public signo. Libraries should read the OpenID Connect endpoints from discovery rather than hard-code them.

## OpenID Connect

| Path | What it is |
|---|---|
| `/.well-known/openid-configuration` | Discovery: the endpoints below and what signo supports |
| `/auth` | Authorization endpoint, where your site sends people to sign in |
| `/token` | Token endpoint, which exchanges a code for tokens |
| `/me` | Userinfo endpoint |
| `/jwks` | The public keys that verify ID tokens |
| `/session/end` | End-session endpoint, for signing out |
| `/request` | Pushed authorization requests (RFC 9126). oidc-provider enables it; signo's tests don't cover it yet |

## For developers

| Path | What it is |
|---|---|
| `/signo.js` | The browser library for single-page apps, as a JavaScript module any site may load |

## For people

| Path | What it is |
|---|---|
| `/account` | The account page: name, passkeys, sign out, delete the account |
| `/account/sites` | Add and manage sites |
| `/privacy` | What this copy stores and who receives it |
| `/trust` | Standards, practices and how to report a security problem |

## For agents

| Path | What it is |
|---|---|
| `/llms.txt` | An index of the docs, as Markdown |
| `/llms-full.txt` | All the docs in one file |
| any page + `.md` | That page as Markdown; `/index.md` for the home page |
| `/.well-known/security.txt` | The security contact, when the operator of the copy has set one |

## Limits

| What | Limit |
|---|---|
| Email links to one address | 5 per 15 minutes |
| Email links from one IP address | 30 per 15 minutes |
| Sign-in attempts from one IP address | 60 per 15 minutes |
| Token requests from one IP address | 600 per minute |