For operators
You run the service, hold its keys and register websites. Members and organisations rely on you to keep records, keys and website accounts continuous.
Run Unanym
Use Unanym’s own email-code accounts and organisation administrators. Supply your domain, email delivery and private storage, then follow the hosting guide. The service can use your own display name; its default is Unanym.
Connect an existing community platform
An optional account-source adapter can read another platform’s accounts and approvals. This needs its own integration and does not make that platform a dependency of Unanym.
Register a website
Add the website to the client registry with its exact callback address, and store a random secret of at least 32 characters in the separate secrets file. Each website needs its own hostname. Restart the service, then send the client ID and secret to the website’s administrator through a private channel.
Offer the example website
Register a client whose only redirect address is https://identity.example/identity/example/callback, with no secret. After a restart the example appears at /identity/example/ and on the overview page. It verifies what it receives the way a real website would and stores nothing; the service records the connection like any other, so members can disconnect it.
Keys
The key file holds the token-signing key, the membership-statement key, the key that seals each website-specific key, and the cookie secret. Websites pin the membership-statement key, so replace it only through a planned rotation with notice to every website.
Back up and restore
Stop the service, then run scripts/backup.js and scripts/restore.js as the hosting guide describes. Keep the issuer, client IDs, keys and profile unchanged on restore.
Replace the sign-in engine
Websites identify members by issuer and per-site identifier. The contract lists the conditions under which the engine can change without websites noticing.
Check the service
/identity/health reports the service, its version and its contract.
Before real members
Name a security contact, test email delivery to real inboxes, and record each organisation’s actual appointment of its approvers. Tests and fictional rehearsals do not establish any of these.