Skip to main content
The user opens your application on a desktop, sees a QR code, scans it with their phone camera and confirms the sign-in in a messaging app. There is no form to fill in and no password to create: signing up happens in the same action as signing in.

​
What your application does

Nothing beyond ordinary OpenID Connect:
Then the standard code-for-tokens exchange. Veriqa needs no client SDK, widget or JS component: the sign-in page with the QR code is rendered by the server.

​
What the user experiences

  1. a QR code appears on screen — that is all the sign-in needs;
  2. the user opens their phone camera, scans it and follows the link;
  3. the messaging app they already use opens — Telegram, WhatsApp or another one (or an email, on the Email channel);
  4. the user confirms with a button — no password, no SMS code;
  5. Veriqa issues the tokens, and the sign-in is done.
The first sign-in and every later one look identical to the user. The difference is on your side: if the sub is new to you, you provision an account; if it is not, you recognize the existing one.

​
What arrives in the claims

sub is the stable subject identifier — the way you recognize a returning user. With scope=profile a human-readable name and related fields come along; the exact set depends on the channel.
Not every channel provides an email. Telegram does not hand out addresses and never will, so the account is created without one. If an email is mandatory for you, use the Email channel or ask for the address in a separate step after the first sign-in. How the off-the-shelf CMSes cope with this is in Veriqa in a CMS.

​
What if the messaging app is not on that device

That is the point: the confirmation happens on another device, the phone. The messaging app does not have to be installed where the user signs in from — which is exactly what separates this from the sign-in buttons built into messaging apps, where your application and the messaging app must share a machine. Same-device sign-in works too, but it is the fallback rather than the main path.

​
Next

Channel linking

Get a live notification channel from the same action.

The full OIDC flow

What happens between authorize and token.