Sign in with byLegit

Fastest way: the drop-in script

Add two script tags and you are done. The script discovers the endpoints, registers your site automatically, and uses a full-page redirect with PKCE — so pop-up blockers can never break sign-in.

<script src="https://bylegit.com/bylegit.js"></script>
<script>
  const bylegit = byLegit.create({
    scope: "openid email profile",
    redirect_uri: window.location.origin + "/login",
  });

  // Runs on page load; returns the signed-in user after byLegit redirects back.
  bylegit.handleRedirect().then((user) => {
    if (user) console.log(user.sub, user.email, user.name, user.tokens);
  });

  document.querySelector("#bylegit-signin")
    .addEventListener("click", () => bylegit.signIn());
</script>

If your current button raises “Popup blocked”, it opens a window instead of redirecting. Replace it with the snippet above: byLegit never needs a popup.

Or use your own OAuth library

Everything is discoverable. Point your OAuth or OpenID Connect library at the discovery document below and it will configure the authorization, token and key endpoints for you.

Discovery document: https://bylegit.com/.well-known/oauth-authorization-server

Client registration

Dynamic client registration is enabled: your client can register itself at the registration_endpoint returned by the discovery document. Register your exact redirect URI — the comparison is byte-for-byte, including the trailing slash.

Authorization code flow with PKCE

1. Redirect the user to the authorization_endpoint with response_type=code, your client_id, your registered redirect_uri, a state value, the scopes you need, and a PKCE code_challenge (S256).
2. The user signs in to byLegit if needed and sees the consent screen listing the data you requested.
3. byLegit redirects back to your redirect_uri with code and state.
4. Exchange the code at the token_endpoint with your code_verifier to receive an ID token and access token.
5. Verify the ID token signature against jwks_uri and check that iss matches the issuer in the discovery document.

Scopes and shared data

Request the smallest set you need. Users can refuse.

• openid

  Required. Returns a stable account identifier (sub).

• email

  The account email address and whether it is verified.

• profile

  Public display name and profile photo.

What is never shared

• Passwords or session cookies.
• Private privacy settings and account deletion requests.
• Unpublished draft reviews.
• Business dashboard data of companies the user manages.

What your users see

Before any data leaves byLegit, the user gets a consent screen naming your application, the redirect address, the exact data requested, and what is never shared. Consent can be refused, and access can be revoked later from the user's byLegit settings.

Integrating with an AI assistant

Give your coding assistant the machine-readable integration file below. It contains the discovery URL, the flow, the scopes and the privacy rules in plain text, so an agent can wire the integration without guessing.

AI integration file: https://bylegit.com/llms.txt

Rules for integrators

• Always use HTTPS redirect URIs, PKCE and the state parameter.
• Never ask users for their byLegit password; only the hosted authorization page collects credentials.
• Store tokens server-side and never expose them in URLs or client-side logs.
• Use the data only for the purpose the user consented to, and delete it when the user disconnects.
• Do not present byLegit reviews as an endorsement of your product.