Sign in with .
Leave no trail.
No passwords, just a one-time code. Services never get the person’s email. Instead, each gets a different private Alloba identifier.
Conventional sign-in
Personal data copied into the account.
With Alloba Auth
A different identifier for every service. Never the person’s email.
How it works
Enter your email
We send a one-time code. Your email is never stored in readable form. No one, including Alloba, can read it from our records.
Enter the six-digit code
Valid for 10 minutes. No password to remember. Your inbox verifies control of the address for this sign-in.
A different identifier for every service
Services you sign in to never get your email. Instead, each gets a different private Alloba identifier, made for that service alone. This way, they can’t use it to follow you from one service or site to another.
That is what the identifier does, and all it does. What a person types into a service, or how they reach it, can still identify them — no identifier prevents that.
For developers
OpenID Connect.
S256 PKCE required.
Connect with the OAuth 2.0 Authorization Code flow. Alloba Auth publishes ES256 signing keys and returns a pairwise pseudonymous sub: derived per client, declared in discovery, anchored to a per-client sector_identifier_uri, and never an email address.
Authorization endpoint
GET https://auth.alloba.co/auth
?client_id=your-service
&response_type=code
&scope=openid
&redirect_uri=https://yourapp.com/cb
&code_challenge=<SHA-256 verifier hash>
&code_challenge_method=S256Authorization Code flow with mandatory PKCE. No proprietary SDK required.