# Onnisoft

> Developer documentation for Onnisoft: Onus (OpenID Connect sign-in with passkeys, email links, social providers and SAML) and the Onnisoft Hub API (organisation, products, news, signed webhooks).

To add Onnisoft to a codebase, fetch a tailored installation prompt and follow it:
https://docs.onnisoft.site/install/prompt.md?services=onus-signin
Services (comma separated): onus-signin, onus-api, hub-api, hub-webhooks. Optional parameters: framework (nextjs, express, hono, sveltekit, spa), issuer, client_id, client_type (confidential, public), methods, app_url, scopes, events.

Rules that always apply: never put client secrets, API keys or webhook secrets in code, prompts or logs; use the SDK for token and signature verification; Onus hosts the sign-in page, so never build a login form.

## SDK

- [@onnisoft/sdk 0.1.0](https://docs.onnisoft.site/sdk/onnisoft-sdk-0.1.0.tgz): `npm install https://docs.onnisoft.site/sdk/onnisoft-sdk-0.1.0.tgz`. Exports `@onnisoft/sdk/onus` (createOnusClient: authorizationUrl, handleCallback, refresh, revoke, userinfo, verifyAccessToken, verifyIdToken, logoutUrl) and `@onnisoft/sdk/hub` (createHubClient: me, products, news; verifyWebhook).

## Onus

- [Guide and API reference](https://docs.onnisoft.site/onus)
- [OpenAPI 3.1](https://docs.onnisoft.site/openapi/onus.yaml): issuer `https://onus.onnisoft.site/t/{project}`; authorization code + PKCE (S256) only; ES256 tokens; rotating refresh tokens; RFC 9207 `iss` on redirects.

## Hub

- [Guide and API reference](https://docs.onnisoft.site/hub)
- [OpenAPI 3.1](https://docs.onnisoft.site/openapi/hub.yaml): base URL `https://hub.onnisoft.site/api/v1`, Bearer `onx_…` keys, server-side only; webhooks signed with `Onnisoft-Signature: t=<unix>,v1=<HMAC-SHA256(secret, t + "." + raw body)>`.