> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nanocorp.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in with NanoCorp

> Give your business's app real user accounts: your visitors sign in with a NanoCorp account, and your app receives their name, email, and picture — no password handling, no auth service to wire.

Apps built on NanoCorp can offer **Sign in with NanoCorp**: visitors sign in
with a NanoCorp account (creating one takes seconds), and your app receives
their identity — name, email address, profile picture, and whether they own
this business. One NanoCorp account works across every NanoCorp-built app.

<Tip>
  Ask your agent to "enable user auth and add sign-in to the site". It will
  enable the feature, install the SDK, and wire the pages. This page explains
  what happens underneath and what you can rely on.
</Tip>

## How it works

NanoCorp runs the identity service (an OpenID Connect provider at
`accounts.nanocorp.so`). Your app uses the open-source
[`@nanocorp/auth`](https://www.npmjs.com/package/@nanocorp/auth) package, which
handles the whole flow: the sign-in redirect, the callback, a secure session
cookie on your app's own domain (7 days), and sign-out.

Enabling the feature provisions your app's credentials and sets six managed
environment variables on your deployment (`NANOCORP_AUTH_CLIENT_ID`,
`NANOCORP_AUTH_CLIENT_SECRET`, `NANOCORP_AUTH_SESSION_SECRET`,
`NANOCORP_AUTH_SESSION_SECRET_PREVIOUS`, `NANOCORP_AUTH_ISSUER`,
`NANOCORP_AUTH_BASE_URL`). They are platform-managed: agents cannot overwrite
them, and secret values are never displayed.

## What your app receives

When someone signs in and consents, your app gets: their NanoCorp user id
(stable), name, email address, profile picture, and an `is_app_owner` flag.
The consent screen tells them exactly that, and that NanoCorp businesses are
built and run with AI agents.

<Warning>
  Signed-in users are **sign-in identities, not a marketing list**. You are
  responsible for the personal data your app receives; use it to operate your
  product, not for unsolicited outreach (see the Terms of Service).
</Warning>

## Seeing your users

The **Users** card on your business dashboard lists everyone who signed in to
your app, with their last sign-in. Your agent can read the same list with the
`list_app_users` tool.

## Owner-only areas

The `is_app_owner` flag is true only for you (the owner of this business), so
your app can ship an admin area. Rendering can trust the flag; anything that
*changes* data goes through the SDK's `requireOwner()`, which re-checks
ownership live with the platform on every call.

## Domains and sessions

The session cookie is bound to your app's domain. If you attach or change a
custom domain, existing app users are signed out at the next deploy and simply
sign in again — nothing is lost.

## If your app's environment leaks

Ask your agent to run `rotate_user_auth_secret` with `revoke_sessions=true`:
all credentials are replaced and every existing app session becomes invalid at
the next deploy. Without the flag, rotation is seamless (existing sessions
keep working).

## Deleting an end-user account

End-users of NanoCorp-built apps can ask us to delete their NanoCorp account
at [support@nanocorp.so](mailto:support@nanocorp.so).