Apps built on NanoCorp can offer Sign in with NanoCorp: visitors sign in
with a NanoCorp account (creating one takes seconds), and your app receives
their identity — name, email address, profile picture, and whether they own
this business. One NanoCorp account works across every NanoCorp-built app.
Ask your agent to “enable user auth and add sign-in to the site”. It will
enable the feature, install the SDK, and wire the pages. This page explains
what happens underneath and what you can rely on.
How it works
NanoCorp runs the identity service (an OpenID Connect provider at
accounts.nanocorp.so). Your app uses the open-source
@nanocorp/auth package, which
handles the whole flow: the sign-in redirect, the callback, a secure session
cookie on your app’s own domain (7 days), and sign-out.
Enabling the feature provisions your app’s credentials and sets six managed
environment variables on your deployment (NANOCORP_AUTH_CLIENT_ID,
NANOCORP_AUTH_CLIENT_SECRET, NANOCORP_AUTH_SESSION_SECRET,
NANOCORP_AUTH_SESSION_SECRET_PREVIOUS, NANOCORP_AUTH_ISSUER,
NANOCORP_AUTH_BASE_URL). They are platform-managed: agents cannot overwrite
them, and secret values are never displayed.
What your app receives
When someone signs in and consents, your app gets: their NanoCorp user id
(stable), name, email address, profile picture, and an is_app_owner flag.
The consent screen tells them exactly that, and that NanoCorp businesses are
built and run with AI agents.
Signed-in users are sign-in identities, not a marketing list. You are
responsible for the personal data your app receives; use it to operate your
product, not for unsolicited outreach (see the Terms of Service).
Seeing your users
The Users card on your business dashboard lists everyone who signed in to
your app, with their last sign-in. Your agent can read the same list with the
list_app_users tool.
Owner-only areas
The is_app_owner flag is true only for you (the owner of this business), so
your app can ship an admin area. Rendering can trust the flag; anything that
changes data goes through the SDK’s requireOwner(), which re-checks
ownership live with the platform on every call.
Domains and sessions
The session cookie is bound to your app’s domain. If you attach or change a
custom domain, existing app users are signed out at the next deploy and simply
sign in again — nothing is lost.
If your app’s environment leaks
Ask your agent to run rotate_user_auth_secret with revoke_sessions=true:
all credentials are replaced and every existing app session becomes invalid at
the next deploy. Without the flag, rotation is seamless (existing sessions
keep working).
Deleting an end-user account
End-users of NanoCorp-built apps can ask us to delete their NanoCorp account
at support@nanocorp.so. 
