I Am Human
Open navigation menu

IAMHUMAN Auth

Human assurance for your service

Let another website request a user's current IAMHUMAN human-assurance status through a standards-based authorization flow.

IAMHUMAN v1 is compatible with OIDC Authorization Code + PKCE, but is not OpenID Certified. It provides only the current HA1 assurance result. It is not real-name or government identity verification, does not prove one person has only one account worldwide, and does not guarantee that a person or content is AI-free.

Authorization Code + PKCE

The user authorizes on IAMHUMAN. Your server exchanges a short-lived, one-use code with the original PKCE verifier; tokens are never returned in the browser URL.

Pairwise subject

Each client receives a different pairwise sub for the same user, reducing correlation across unrelated services. Human ID is not disclosed as the OIDC subject.

Narrow assurance boundary

human:status reports the current HA1 status and its time boundary. Your service must make its own risk, eligibility, moderation, and legal decisions.

Discovery is authoritative

Read the current authorization, token, UserInfo, issuer, signing algorithm, and JWKS endpoints from the discovery document. Do not hard-code endpoints copied from this page.

GET /.well-known/openid-configuration

Integration sequence

  1. 01Apply with your legal contact, HTTPS policies, exact redirect URIs, requested scopes, and use case.
  2. 02After approval, store the issued client credentials only on your server and read the discovery document.
  3. 03Create state, nonce, and an S256 PKCE challenge for every authorization request; verify all three on return.
  4. 04Validate the ID token and issuer, then use only the approved claims and provide users a way to disconnect.
Checking your verified session…