# One account. Your app's.

> Readers signed in to your app arrive signed in on your PixelGlass site. A short signed token from your server, a secret only the owner makes.

When your readers already have accounts in your app, they need no second one. **Your app signs a short token, and the site signs the reader in as that member**, to comment, reply and vote.

**Early access.** This guide uses a feature in early access. PixelGlass turns it on for a publication on request while it is new.

## By hand, in the admin

1. As the owner, open **Settings › Audience › Single sign-on** and press **Make a secret**. Copy it: it is shown once. It belongs on your app's server.
2. Turn on **Sign readers in from your app**.
3. Fill in your app's **Session endpoint**, **Sign-in page** and **Sign-out page**, each an https address. Save.
4. Under **Readers sign in**, choose **With your app or an email code**, or **With your app only**.
5. Give your developer the **Link-in address** and the **Audience (aud)** under **For your developer**.

## With your agent


No tool touches single sign-on. The secret signs anyone in as any reader, so the owner makes it by hand. A coding agent in your app's code can write the token and the session endpoint from the guide linked on that screen.

## Examples

- **A cooking app's community.** A cooking app signs its users in on its PixelGlass community. **A cook who is signed in to the app comments at once**, with no second account.
- **Sign-out that follows.** A software company's readers sign out in its app. The session check signs them out of the site as well.
- **Your app only.** A members' club chooses With your app only. The site's Sign in goes to the club's own sign-in page, and nobody gets an email code.

## Questions

### How does single sign-on work on PixelGlass?

Your app's server signs a JWT with HS256 and the secret from Settings › Audience › Single sign-on. The site checks it and signs the reader in as that member.

### What does the token carry?

Your user's id in your app, their address, an optional name, your site's host, and a new random id. It works once, for five minutes at most.

### Which member does a token sign in?

The member with your app's id. If none has it, the member with that address. If neither exists, PixelGlass makes a confirmed member on no newsletter.

### Does a sign-in add the reader to my newsletter?

No. A member made by single sign-on joins no newsletter, because a sign-in is not consent to email.

### What happens when I make a new secret?

The new secret is shown once, and the old one works for one more day, so your app can change over.

### Who can turn on single sign-on?

The owner alone, because the secret signs anyone in as any reader.

## See also

- [Let readers sign in](https://pixelglass.co/guides/let-readers-sign-in): Readers sign up and sign in with a six-digit code by email, with no password. Turn it on, place the doors in your menus, by hand or with your agent.
- [Sync members from your app](https://pixelglass.co/guides/sync-members-from-your-app): Keep your app's users and your PixelGlass members in step over the admin's JSON: find by address, add, change, label, and change many at once.
- [Make a staff key](https://pixelglass.co/guides/make-a-staff-key): A staff key acts as you, inside your role, on the admin's JSON and the MCP server. Make one, copy it once, remove it to close it.
- [Developer API](https://pixelglass.co/features/developers): Read your site as JSON, sync members from your app, sign readers in with your own accounts, and run it all from an agent. Webhooks are coming soon.
- [Members and comments](https://pixelglass.co/features/community): Give readers a member account with no password, a conversation under every post, and badges that honour your supporters. Moderated by your team.
- [Every guide](https://pixelglass.co/guides)
- [Pricing](https://pixelglass.co/pricing): every feature on every plan, 14 days free
- [Create your site](https://pixelglass.co/signup)