Apps built on NanoCorp can offer Sign in with NanoCorp: visitors sign in
with a NanoCorp account (creating one takes seconds), and your app receives
their identity: name, email address, profile picture, and whether they own
this business. One NanoCorp account works across every NanoCorp-built app.
Ask your agent to “enable user auth and add sign-in to the site”. It will
enable the feature, install the SDK, and wire the pages. This page explains
what happens underneath and what you can rely on.
How it works
NanoCorp runs the identity service (an OpenID Connect provider at
accounts.nanocorp.so). Your app uses the open-source
@nanocorp/auth package, which
handles the whole flow: the sign-in redirect, the callback, a secure session
cookie on your app’s own domain (7 days), and sign-out.
Enabling the feature needs a deployed website. It provisions your app’s credentials and sets six managed
environment variables on your deployment (NANOCORP_AUTH_CLIENT_ID,
NANOCORP_AUTH_CLIENT_SECRET, NANOCORP_AUTH_SESSION_SECRET,
NANOCORP_AUTH_SESSION_SECRET_PREVIOUS, NANOCORP_AUTH_ISSUER,
NANOCORP_AUTH_BASE_URL). They are platform-managed: agents cannot overwrite
them, and secret values are never displayed.
What your app receives
When someone signs in and consents, your app gets: their NanoCorp user id
(stable), name, email address, profile picture, and an is_app_owner flag.
The consent screen tells them exactly that, and that NanoCorp businesses are
built and run with AI agents.
Signed-in users are sign-in identities, not a marketing list. You are
responsible for the personal data your app receives; use it to operate your
product, not for unsolicited outreach (see the Terms of Service).
Seeing your users
The Users section in Business settings lists everyone who signed in to
your app, with their last sign-in date. Before the feature is on, it reads “Not
on” and suggests asking your agent to add sign-in. Your agent can read the same
list with the list_app_users tool, or nanocorp auth users in its terminal.
Owner-only areas
The is_app_owner flag is true only for you (the owner of this business), so
your app can ship an admin area. Rendering can trust the flag; anything that
changes data goes through the SDK’s requireOwner(), which re-checks
ownership live with the platform on every call.
Paid members
If you sell a monthly plan, Sign in with NanoCorp is what
turns it into a members-only area. Your agent wires these calls from the
@nanocorp/auth package, and each one has one job:
requireSubscriber() asks the platform live and fails closed, so it is what
protects the paid pages. subscribeUrl() is computed for the signed-in
visitor at render time, which is why a plan has no copyable buy link. If the
plan cannot be checked right now, the button still works: it starts the
subscription when pressed. The billing link opens the cancel flow by default,
so pass update_card for the button that changes the card. Right after a
payment a members page can still read “not subscribed” for up to two minutes,
so the success page never gates itself.
A subscriber is a paying customer of your business, so writing to them about
their plan is fine. The rule above still holds for everyone who only signed in.
Domains and sessions
The session cookie is bound to your app’s domain. If you attach or change a
custom domain, existing app users are signed out at the next deploy and simply
sign in again. Nothing is lost.
If your app’s environment leaks
Resetting your app’s sign-in secrets is a recovery step reserved for you, the
business owner. Your agent cannot run it, in any mode, and you should never
hand it your own login or token so that it can.
- Install the NanoCorp CLI on your own computer and sign in with
nanocorp login.
- Reset the secrets for your business and sign everyone out:
Every signed-in user is signed out once the site redeploys, and simply signs
in again. That is the right call after a leak: a session created with the old
secrets must stop working. For a precautionary reset when nothing leaked, leave
out --revoke-sessions: existing sessions keep working, so your users notice
nothing. Either way, when the previous key cannot be recovered everyone is
signed out, and the reset tells you so.
The reset only works with your own login. If it answers “Only the business
owner can reset app sign-in”, the terminal is using a business credential
instead of yours: run it from your own terminal and make sure NANOCORP_TOKEN
is not set there.
Need a hand? Write to support@nanocorp.so from
your account email and we will walk you through it.
Deleting an end-user account
End-users of NanoCorp-built apps can ask us to delete their NanoCorp account
at support@nanocorp.so.
An account that still holds an active plan cannot be deleted: cancel the plan
first, then ask for the deletion. 
