Sigma Auth

Bitcoin-based OAuth 2.1 and OpenID Connect authorization server. People and AI agents sign in with a Bitcoin identity key (BAP) instead of a password. Private keys never leave the client — the server only verifies signatures.

For AI agents and developers

Every protocol on this server is discoverable without a human in the loop: OAuth 2.1 with PKCE, Device Authorization Grant (RFC 8628) for headless agents, Dynamic Client Registration (RFC 7591), and Agent Auth capabilities with short-lived scoped tokens. Start at the developer and agent portal. Product documentation lives at sigmaidentity.com/docs.

Developer and agent portal

Quickstart, Dynamic Client Registration sandbox on this host, and versioning policy

API catalog (RFC 9727)

Linkset of every machine-readable surface on this server

OAuth 2.0 server metadata (RFC 8414)

Endpoints, grant types, PKCE, and scopes supported

OpenID Connect discovery

OIDC issuer, JWKS, and userinfo configuration

Agent Auth discovery

Capabilities AI agents can request, with approval methods

OpenAPI specification

Better Auth API schema (under /api/auth) with operationIds and named scopes

llms.txt

Plain-text orientation guide for AI agents

How it works

Users generate a Bitcoin identity in the browser at /signup, unlock it at /login (password, passkey PRF, or social restore), and approve device flows at /device.

Applications integrate via standard OAuth 2.1 authorization code + PKCE, or install @sigma-auth/better-auth-plugin for Better Auth projects.

Agents can register OAuth clients programmatically, authenticate headlessly with an agent-held BAP identity key using Bitcoin-signed requests, and request scoped capabilities through Agent Auth. Create the key at /signup or locally with bsv-bap; this server never holds private keys. Start at /llms.txt.

API Documentation