A hosted sign-in
The sign-in runs on the Noir origin, passkey first, with fallbacks, rate limits and recovery handled by Noir ID.
You do not write a login page, a password reset or a passkey ceremony.
One account.
A different subject at every website.
Noir ID is open in beta at id.noir.bzh. People sign in with one Noir account. Each connected website receives its own pseudonymous subject and keeps its own customer directory.
Noir account
Account anchor, never released to a website
Website A
Subject
sub_a7f2…Website A directory
Website B
Subject
sub_f91c…Website B directory
What a website
receives
Three things a product does not have to build, and what each one still leaves to you.
A subject model
Each client gets a pairwise pseudonymous subject, derived and stable for that one relationship.
You do not have to decide what a user identifier means across products.
A management surface
Clients and their exact callbacks, tenant-scoped directory records, invitations and an append-only audit trail.
You do not build an admin console to register your own applications.
The protocol
- Standard
- OpenID Connect
- Flow
- Authorization code with PKCE (S256)
- Subject
- Pairwise, per client
- Sign-in
- Hosted on the Noir origin, passkey first
- Authorization
- Stays in your product
Honest answers
Can two products work out that I am the same person?
Not from the subject: each product receives a different one. But if both also receive your email address, the email is the join. That is why the claims released to each website are kept to a minimum.
What happens to my product if Noir ID is down?
Existing sessions keep working, because your product holds its own session. New sign-ins fail until Noir ID is back, so treat a failed sign-in as a failed sign-in, not an outage.
Does Noir ID decide what a user can do in my product?
No. Noir ID answers who is signing in and what has been released to you. Roles, resources and decisions stay in your product.
How do I leave?
Plan for it before you adopt: confirm that the management API exports the directory and each client mapping in a form your replacement can use, and test the handoff, because an export alone may not reproduce identical subjects.
Is it production ready?
Not yet: Noir ID is in beta. Accounts are real and use standard OpenID Connect, but there has been no external security audit, and during the beta we register each website ourselves. Validate callbacks, claims, failure paths and recovery in your own environment. We claim no certifications.