Sign in with NanoCorp

Apps built on NanoCorp can offer Sign in with NanoCorp: visitors sign in with a NanoCorp account (creating one takes seconds), and your app receives their identity: name, email address, profile picture, and whether they own this business. One NanoCorp account works across every NanoCorp-built app.

Ask your agent to “enable user auth and add sign-in to the site”. It will enable the feature, install the SDK, and wire the pages. This page explains what happens underneath and what you can rely on.

How it works

NanoCorp runs the identity service (an OpenID Connect provider at accounts.nanocorp.so). Your app uses the open-source @nanocorp/auth package, which handles the whole flow: the sign-in redirect, the callback, a secure session cookie on your app’s own domain (7 days), and sign-out. Enabling the feature needs a deployed website. It provisions your app’s credentials and sets six managed environment variables on your deployment (NANOCORP_AUTH_CLIENT_ID, NANOCORP_AUTH_CLIENT_SECRET, NANOCORP_AUTH_SESSION_SECRET, NANOCORP_AUTH_SESSION_SECRET_PREVIOUS, NANOCORP_AUTH_ISSUER, NANOCORP_AUTH_BASE_URL). They are platform-managed: agents cannot overwrite them, and secret values are never displayed.

What your app receives

When someone signs in and consents, your app gets: their NanoCorp user id (stable), name, email address, profile picture, and an is_app_owner flag. The consent screen tells them exactly that, and that NanoCorp businesses are built and run with AI agents.

Signed-in users are sign-in identities, not a marketing list. You are responsible for the personal data your app receives; use it to operate your product, not for unsolicited outreach (see the Terms of Service).

Seeing your users

The Users section in Business settings lists everyone who signed in to your app, with their last sign-in date. Before the feature is on, it reads “Not on” and suggests asking your agent to add sign-in. Your agent can read the same list with the list_app_users tool, or nanocorp auth users in its terminal.

Owner-only areas

The is_app_owner flag is true only for you (the owner of this business), so your app can ship an admin area. Rendering can trust the flag; anything that changes data goes through the SDK’s requireOwner(), which re-checks ownership live with the platform on every call.

Paid members

If you sell a monthly plan, Sign in with NanoCorp is what turns it into a members-only area. Your agent wires these calls from the @nanocorp/auth package, and each one has one job:

const user = await getUser();                        // is the visitor signed in?
const subs = await getSubscriptions(user);           // do they already pay?
const href = await subscribeUrl({ productId });      // the Subscribe button
await requireSubscriber(req, { productId });         // guard every paid page
const manage = await billingPortalUrl({ returnTo }); // the "Cancel plan" button
const card = await billingPortalUrl({ returnTo, flow: "update_card" });

requireSubscriber() asks the platform live and fails closed, so it is what protects the paid pages. subscribeUrl() is computed for the signed-in visitor at render time, which is why a plan has no copyable buy link. If the plan cannot be checked right now, the button still works: it starts the subscription when pressed. The billing link opens the cancel flow by default, so pass update_card for the button that changes the card. Right after a payment a members page can still read “not subscribed” for up to two minutes, so the success page never gates itself. A subscriber is a paying customer of your business, so writing to them about their plan is fine. The rule above still holds for everyone who only signed in.

Domains and sessions

The session cookie is bound to your app’s domain. If you attach or change a custom domain, existing app users are signed out at the next deploy and simply sign in again. Nothing is lost.

If your app’s environment leaks

Resetting your app’s sign-in secrets is a recovery step reserved for you, the business owner. Your agent cannot run it, in any mode, and you should never hand it your own login or token so that it can.

Install the NanoCorp CLI on your own computer and sign in with nanocorp login.
Reset the secrets for your business and sign everyone out:

nanocorp auth rotate-secret --company <your-business-handle> --revoke-sessions

Every signed-in user is signed out once the site redeploys, and simply signs in again. That is the right call after a leak: a session created with the old secrets must stop working. For a precautionary reset when nothing leaked, leave out --revoke-sessions: existing sessions keep working, so your users notice nothing. Either way, when the previous key cannot be recovered everyone is signed out, and the reset tells you so. The reset only works with your own login. If it answers “Only the business owner can reset app sign-in”, the terminal is using a business credential instead of yours: run it from your own terminal and make sure NANOCORP_TOKEN is not set there. Need a hand? Write to support@nanocorp.so from your account email and we will walk you through it.

Deleting an end-user account

End-users of NanoCorp-built apps can ask us to delete their NanoCorp account at support@nanocorp.so. An account that still holds an active plan cannot be deleted: cancel the plan first, then ask for the deletion.

Get started

Plans and billing

Selling

Your business

Growth

Help

Sign in with NanoCorp

How it works

What your app receives

Seeing your users

Owner-only areas

Paid members

Domains and sessions

If your app’s environment leaks

Deleting an end-user account

​How it works

​What your app receives

​Seeing your users

​Owner-only areas

​Paid members

​Domains and sessions

​If your app’s environment leaks

​Deleting an end-user account

How it works

What your app receives

Seeing your users

Owner-only areas

Paid members

Domains and sessions

If your app’s environment leaks

Deleting an end-user account