ComplyAge
A rusted door with a stencilled key symbol.

Privacy-first age verification

OAuth / SSO

Let users sign in with ComplyAge and bring their verified status with them. Free, and built for clean integration.

Get started

ComplyAge OAuth/SSO is an OpenID Connect-style authorisation flow. A partner site sends the user to ComplyAge, the user approves the requested scopes on a consent screen, and the site receives a code it exchanges for tokens. With those tokens the site can read the user's identity claims and their verification status — so a person verified once carries that status to every partner they connect. It is free on every plan.

The flow

Standard authorisation-code flow: redirect to the authorise endpoint with your client id, redirect URI, scopes and a state value; the user signs in (or is already signed in) and approves the consent screen; ComplyAge redirects back with a code; your server exchanges the code for tokens; you call userinfo and, if you asked for it, the verifications endpoint. Users can review and revoke every grant from their members portal.

Verification status, not documents

The verifications scope returns what has been verified — method, time, outcome — never the evidence. A partner learns that a user is a verified adult, or that their username was verified, without receiving an ID image, a face or a card.

Verify inside the flow

If your integration requires a verification the user does not yet hold, the flow can start one inline: the verification window opens, the user completes an accepted method, and the flow resumes with the new status. No separate integration is needed to get from sign-in to verified.

Endpoints

All under the oauth host. Authorise and consent are browser-facing; token, userinfo and verifications are server-to-server with your client secret.
  • GET /oauth/v1/authorize — start the flow
  • POST /oauth/v1/token — exchange the code for tokens
  • GET /oauth/v1/userinfo — identity claims for the token
  • POST /oauth/v1/verifications — verification status for the token
  • POST /oauth/v1/revoke — revoke a token

Integrate in four steps

  1. Register your redirect URI

    In the members portal, add the OAuth redirect URI(s) for your integration and copy the client id and secret. Test and live credentials are separate.

  2. Send the user to authorise

    Redirect the browser with your client id, redirect URI, the scopes you need and a random state value you will check on return.

    https://oauth.complyage.org/oauth/v1/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https://example.com/callback&scope=identity%20verifications&state=RANDOM

  3. Exchange the code

    On your callback, verify the state, then POST the code with your client credentials to the token endpoint from your server.

  4. Read identity and verification status

    Call userinfo for the user's claims and verifications for their verified methods. Store the ComplyAge subject id — it is stable across sessions and partners.

Frequently asked questions

Is OAuth/SSO really free?
Yes, on every plan. You pay only for billed verifications a user completes, whether inside the OAuth flow or through the Age Gate.
Is it OpenID Connect?
It follows the OpenID Connect shape — authorisation-code flow, consent, userinfo — with a ComplyAge verifications extension. Standard OAuth client libraries work with it.
Can users revoke access?
Yes. Every grant is listed in the user's members portal with a revoke button; revocation invalidates the partner's tokens.
Can I link an existing account by email?
Yes. A link-by-email endpoint connects an existing partner account to a ComplyAge identity after the address is confirmed with a one-time code.