Developer identity
GitHub
OAuth authentication with minimal profile and verified-email scopes, followed by API identity revalidation.
Architecture Demos
Choose a capability, run one focused demonstration, and inspect what happened.
OAuth 2.0
Sign in with GitHub authorization code and PKCE, then inspect API identity revalidation and application authorization.
OAuth 2.0
GitHub authorization code with PKCE is followed by authenticated API identity revalidation before a session is created.
This clears your WizardGang session and sign-in flow cookies. Microsoft, Google, and GitHub retain their own sessions.
Sign in
Choose a trust relationship
Credentials and protocol secrets stay on the Worker.
Authenticated
Identity
ProviderAuthenticated
Received → validated
Validated provider payload
Application contract
Normalized identity
Only fields legitimately derived from validated provider data cross this boundary.
Application authorization
What can this identity do?
Authenticated identity
demo:read → authenticated identity
demo:write → authenticated identity, visitor sandbox only
caller-selected namespaces → managed operator credential only
demo:write → authenticated identity, visitor sandbox only
caller-selected namespaces → managed operator credential only
Trust evidence