Sign in with Storytailor

Child-safe identity without holding a child’s identity. A parent authenticates and authorises, and the child never authenticates. You receive a pseudonymous profile (an ID name, a character avatar, an age band) and never a real name, birthdate, or photo. Free, always.

Standard OIDC

Issuer:    https://auth.storytailor.com
Discovery: https://auth.storytailor.com/.well-known/openid-configuration
JWKS:      https://auth.storytailor.com/.well-known/jwks.json

Authorization-code flow with PKCE (S256), RS256 id_tokens, rotating refresh tokens, single-use codes, revocation. Any conformant OIDC client library works.

Scopes

Scope	What the app receives
`stid.basic`	Pseudonymous subject, ID name, character avatar
`stid.age_band`	3-5 / 6-8 / 9+, never a birthdate
`stid.age`	Exact age in years. Purpose-gated: you register a parent-visible reason, and the parent may downgrade it to a band or refuse
`stid.reading_profile`	Reading-support settings
`stid.themes:write`	Write back observed themes from controlled vocabulary
`parent.basic`	The parent’s own subject and verified email, so you can create their account. Purpose-gated

The token response’s scope is authoritative: a parent may have granted less than you asked for. Respect it. Ask only for what your app does today, and add scopes as features ship.

Try the whole flow now

An interactive demo runs the real consent experience and saves nothing. Any email, code 000000:

https://auth.storytailor.com/oauth/authorize
  ?client_id=siws-e2e-demo
  &redirect_uri=https%3A%2F%2Fexample.com%2Fsiws%2Fcallback
  &scope=stid.basic%20stid.age_band
  &state=review&demo=1

What you must never do

Do not attempt to de-pseudonymise: no correlating the subject with outside data to recover a child’s identity, and no storing claims beyond the purpose you registered. This is a condition of access, and access ends in one field.