unanym

For website owners

Let members sign in with Unanym and open a members-only page for people an organisation has approved. You decide which organisations your site recognises.

What you need

  • WordPress with PHP 8.1 or newer and the Sodium extension
  • The OpenID Connect Generic Client plugin (tested with 3.11.3)
  • The Unanym companion plugin, from the download on the overview page
  • A staging copy of your site to test on first

Who registers your website?

An operator runs the identity service and registers the websites it connects. Choose the operator providing your community’s identity service. This public documentation site does not register accounts or websites. Agree registration before entering connection settings. Downloading the plugin does not register your site.

If you want to run a separate service for your community, start with the operator guide. For existing accounts, privacy and support, read Webmaster questions.

Connect your site

  1. Install both plugins on the staging site.
  2. In Settings → Unanym, copy the callback address and send it to the operator. They register your site and send you a client ID and secret through a private channel.
  3. Enter the issuer address supplied by your operator, the client ID and the secret, and save. The plugin records the operator’s membership key; check its fingerprint with the operator.
  4. Add the ID of each organisation your site recognises. The operator or the organisation gives you these. With none added, signing in grants no membership-based access.

Open a members-only page

  1. Create a page and set its visibility to Private.
  2. In Settings → Unanym, choose that page and the organisation it requires, and save the member area.
  3. Members who share that membership see Open member area after signing in.

Access is checked on every visit and is never a permanent role. The page stays private if the companion is disabled, and cannot be published by accident while it is the member area. Your editors and administrators keep their usual access.

Test before real members use it

  1. Sign in as a test member, share the membership and open the page.
  2. Withdraw the approval, reload the page: access closes.
  3. Disconnect the site in Your places: the sign-in session ends.

Accounts on your site

New members become Subscribers. Existing users connect from their WordPress profile after signing in the usual way; accounts are never matched by name or email, and no email address is supplied. If the identity service cannot be reached, member access fails closed.

What this does not protect

Uploaded files and media links, your other public pages, other membership plugins, custom APIs, and caches that bypass WordPress. Set your cache to skip signed-in and private pages, and keep member files out of public uploads.

Other platforms

Any OpenID Connect client can sign members in with the authorization code flow and S256 PKCE. Checking membership statements needs the verification described in the contract. Only WordPress is tested.

All guides