How signing in to sites with Omxus works

Sites and apps use Omxus so you don't need a new username and password for each one. Omxus checks it's you, and tells the site only what it needs.

Two ways a site can use Omxus

Both use the same Omxus account.

What happens when you sign in

1. You sign in with your password, passkey, code, or name, date of birth and secret words.
2. If you don't have a username for this site yet, you choose one.
3. Omxus lets the site know you're signed in, and shares only the details the site asks for and is set up to receive. See what a site can receive.
4. The site signs you in to its own service.

Omxus follows OpenID Connect, a widely used open standard for signing in to sites (Sakimura et al., 2014). Omxus only sends you back to web addresses the site registered in advance, and every sign-in carries a one-time check, called PKCE, so a sign-in someone intercepts on the way back is useless to them (Sakimura, Bradley & Agarwal, 2015).

What stays separate

• Your Omxus account and your account on the site are separate. The site keeps what you do there. Omxus doesn't see it.
• Deleting one doesn't delete the other. Deleting your Omxus account doesn't delete your posts or purchases on a site. Ask the site to delete those.
• The site's own rules apply on the site. Read its privacy policy and terms.