OpenID Connect, live
This app has no password system.
It doesn't store your credentials, check your password, or manage your account. It hands all of that to a separate identity provider — and that provider is the thing being demonstrated.
Use a throwaway email — it's never sent to. Every account and every credential is wiped nightly.
You've seen this pattern before
Every “Sign in with Google” button works this way — the app delegates identity to a
provider and never touches your password. The difference here is that the provider isn't Google.
It's can-id: roughly 24,500 lines of Go, built from the published internet standards rather
than assembled from an existing library, and running right now at https://auth.andrewbello.ca.
What to watch for
You'll be sent to a different domain to sign in, then returned here. When you land back, this page shows you exactly what identity was handed over — and every cryptographic check the app performed before agreeing to trust it.
That verification is the part that matters. Any app can display a name; the work is proving the claim came from the right issuer, was meant for this app, hasn't expired, and hasn't been replayed.
Standards implemented
OpenID Connect Core & Discovery · OAuth 2.0 with mandatory PKCE (S256) · DPoP sender-constrained tokens · Pushed Authorization Requests · Device Authorization Grant · JWT Bearer · Token Introspection & Revocation · Back-Channel Logout · SAML 2.0 IdP · SCIM 2.0 provisioning · TOTP and WebAuthn/passkey second factors · bilingual EN/FR.