meowerse_

auth

One meowerse account for every meowerse app: sign in with a password or with Telegram.

working: auth — checking…

open auth (opens in a new tab)source (opens in a new tab)

what it is

  • Meowerse accounts is the sign-in that meowsenger and other meowerse apps use.
  • You create one account, then choose app by app what it may see: your username, your Telegram link, or whether your account is verified.
  • You can verify your account by linking Telegram, keep one-time recovery codes, and revoke any app's access from your account page.
  • There is no email, no advertising and no analytics.

how it works

  • It is an OAuth 2.0 and OpenID Connect provider. An app sends you to /authorize with PKCE (S256, required for every app) and gets a one-time code back.
  • The app exchanges the code at /token for ES256-signed ID and access tokens, which anyone can check against the published JWKS.
  • Passwords are stored only as salted PBKDF2-SHA256 hashes, and a session is a __Host- cookie that holds a random ID.
  • One Cloudflare Worker serves both the pages and the API; account data lives in Turso.
Sign-in flow: an app sends you to auth, you sign in and consent, and the app gets signed tokens.your appsends you to /authorizeauth.alxnko.devpassword or telegramconsentyou choose what it seesone-time codeexchanged at /token + pkcesigned tokenses256, checked via jwks

at a glance

protocol
OpenID Connect, authorization code flow with PKCE
tokens
ES256 JWTs, public keys at /jwks
sign-in
username and password, or Telegram
runs on
Cloudflare Workers, Turso