Sign in with Comms.ID, ready to copy

Templates

• Plain HTML

  A static page with the <comms-id-sign-in> element from cdn.comms.id, and a small Worker that runs the sign-in. No build step for the page.

  npx degit comms-id/relyingparty-app/templates/html my-app

• React

  A Vite React app with SignInButton from @comms-id/sign-in-react, served by the same kind of Worker.

  npx degit comms-id/relyingparty-app/templates/react my-app

• Next.js

  Next.js on Cloudflare Workers: route handlers run the sign-in, and the page reads the session on the server.

  npx degit comms-id/relyingparty-app/templates/nextjs my-app

Make it yours

1. Copy a template and install it: pnpm install.
2. In wrangler.jsonc, set the Worker name and COMMS_ID_REDIRECT_URI to https://<your host>/auth/callback.
3. Deploy it once: pnpm run deploy. The page and the sector document are live; sign-in answers that it is not set up yet.
4. Make the signing key: npx comms-id key --worker <your Worker>. It puts the private key in the Worker secret COMMS_ID_PRIVATE_JWK and prints the public key.
5. Register the app in Companion: the public key, the redirect URI, the sector document https://<your host>/oidc/redirect_uris and the sign-in class.
6. Set COMMS_ID_CLIENT_ID to the client id Companion gives you, and deploy again.

Each template's README.md has the details. The app keeps the key on its server; the browser holds only a session cookie.

What these templates keep

The only store is one Durable Object for each session: your pairwise id for that template, your Team Membership when you sign in for a Team, and the ID token. It is deleted about 70 minutes after you sign in: 10 minutes after the ID token expires. No name is asked for (scope openid), and nothing else is kept.

The templates are our own test bed: they sign in against production Comms.ID, and nothing depends on them. Each template is its own app, so each one sees a different id for you.