One login for
every WholeWorldCoding app.
Username & password, Google, Discord, Telegram, GitHub, Apple, custom OIDC, and passkeys. Any app can request auth with just a client_name. No per-app user tables ever again.
// Redirect user to WWC Auth
const authUrl = `https://auth.wholeworldcoding.com/oauth/authorize?` +
new URLSearchParams({
client_name: "My Cool App", // auto-provisions a client
redirect_uri: "https://myapp.com/callback",
scope: "openid profile email",
state: crypto.randomUUID(),
});
window.location = authUrl;
// Then exchange `code` for tokens at /oauth/token and verify via /oauth/userinfo
openid profile email alias offline_access — all non-sensitive, no Google verification needed.Testing without an app? Use
redirect_uri=http://localhost:8000/demo/callback — it shows the code and curl exchange. If you used :3000/callback and saw “refused to connect”, switch to the demo callback (auto-appended for wwc_* localhost clients).
7 login methods
Password, Google, Discord, Telegram, GitHub, Apple, custom OIDC, plus WebAuthn passkeys for passwordless.
Any app, zero setup
Pass client_name + redirect_uri and we auto-create the client. No dashboard pre-registration required.
Gateway protections
Brute-force rate-limiting, IP blacklisting, audit logs, and abuse detection once at the gateway — not in every app.
Extended ecosystem — built-in
📧 Privacy Email Aliasing
Every user gets username@wholeworldcoding.com that forwards to their real inbox and rewrites outbound replies.
👤 Unified Profile & Metadata Store
Themes, preferences, and custom attributes synced across all ecosystem apps. GET /api/profile/:user_id.
☠️ Global Security Dashboard & Kill-Switch
See every authorized app, audit log, and revoke all access with one click.
Open dashboard →🔔 Ecosystem Webhooks
user.created, profile.updated, app.revoked dispatched to every subscribed app in real-time.
🚦 Built-In Rate Limiting
Flask-Limiter at the gateway. No need to re-implement in each micro-app.
🎭 Cross-App RBAC
owner / admin / member / guest managed centrally; propagates to new apps automatically.
📱 Trusted Device Management
View active sessions, trust a browser, or sign out a forgotten laptop remotely with new-device alerts.
Ready to plug Chatter into WWC Auth?
Read README.md for the Flask drop-in snippet and JWT verification example.