A sign-in your coding agent can wire up on its own
A hosted OpenID Connect provider with a written contract for agents: hand your agent one link and one brief, and it does the integration — environment variables, callback route, session, protected routes. For Next.js there is a package; for everything else, plain OIDC.
The first connection is made on your ZERNO project.
- We keep passwords, sessions and recovery; you get a client_id and a redirect URI
- Sign-in methods flip with a toggle, no site release
- Site audiences are isolated: signing in on one is not signing in on another
Sign in to ZERNO
Welcome back
Continue with Mail
Continue with Одноклассники
Continue with VK ID
Continue with Яндекс ID
Accounts are kept by ZERNO ID — what happens to your data.
Someone hits “Sign in” — the site sent them to id.zerno.one with a client_id and a redirect URI
The form is live — the very component that runs on id.zerno.one.
And this is your side
A cabinet per site: sign-in methods on toggles, the key and the redirect URI, the list of people and the latest sign-ins.
Климатвер
подключёнclimate-wear.ru · 413 чел. входило за 7 дней
Why this holds up
How to connect
- 1Create a connectionGive a redirect URI like https://your-site/api/auth/callback — get a client_id and a secret.
- 2Pick sign-in methodsZERNO ID in one press, email link, passkey, password, Yandex ID — and in the global region, Google and GitHub. Toggled in the cabinet, not in your code.
- 3Hand it to your agentCopy the brief out of the cabinet and point the agent at the machine-readable guide. It writes the callback route and the session itself, then runs the verification checklist.
Beyond the sign-in itself
Sign-in sits at the single point every one of your users passes through — and sees what the site itself never does.
It is plain OIDC — this is the whole integration
No SDK of ours: any library that speaks OpenID Connect works with us out of the box.
# 1. Все адреса берутся из метаданных
GET https://id.zerno.one/.well-known/openid-configuration
# 2. Отправляем человека на форму входа
GET https://id.zerno.one/oauth/authorize
?response_type=code
&client_id=<ваш client_id>
&redirect_uri=https://<ваш домен>/auth/callback
&scope=openid+email+profile
&state=<случайная строка в сессии>
&code_challenge=<S256 от code_verifier>
&code_challenge_method=S256
# 3. Меняем код на токены — сервер-сервер, секрет в браузер не попадает
POST https://id.zerno.one/oauth/token
grant_type=authorization_code&code=<code>
&client_id=<ваш client_id>&client_secret=<секрет>
&code_verifier=<verifier>Let your agent do it
The integration guide is written for a coding agent, not for a person: environment variables, recipes for Next.js, Django, Express and PHP, and a verification checklist. Copy the brief out of the cabinet, give the agent the link, and it takes it from there.
What it costs
The price follows the number of sites and the paperwork you need — not the number of your users. Monthly actives are a ceiling on the plan, not a line on the invoice.
- 1 site, up to 1,000 monthly actives
- Email and Yandex ID sign-in
- Sign-in form on id.zerno.one, ZERNO branded
- User list and secret rotation
- Sign-in events into your database: signed webhooks with retries
- Returns and dormant users: who signed in, who vanished, who gets locked out
- 1 site, up to 10,000 monthly actives
- Every sign-in method available in your contour
- Support answers within a business day
- Sign-in form on your own subdomainsoon
- ZERNO branding removed from the formsoon
- Up to 5 sites, 50,000 monthly actives in total
- Invoice for a legal entity, acts and UPD
- Signed data-processing instruction naming the facility
- Priority support
- Several administrators per sitesoon
- Webhooks on sign-in eventssoon
- Hand a site over to the clientsoon
- As many sites and users as you need
- Contract with the facility address attached
- Agreed SLA and response time
- Isolated sign-in contour
Worth knowing upfront
- Accounts are stored in Russia and the invoices are in roubles. That is the right answer for a Russian site and the wrong one for some others — decide before you build on it.
- Which sign-in methods you can offer depends on the region you pick when the site is connected. The Russian region has no Google, Apple or GitHub buttons at all.
- Each site keeps its own user base: signing in on one is not signing in on another.
- The user profile belongs to your site. We own the sign-in, not your customers' account pages.
- Secrets rotate without reinstalling; the old one stops working immediately.