POINTCAST · CONNECT · v1

Sign in with PointCast.

A login for the small web that does not track you. Your town card goes with you to any site that asks, and nothing follows you home.

Add it to your site

01

Nothing to register

Your site's address is its name. No keys, no dashboard, no approval queue. One script tag.

02

You see what they get

Your card, and your Tezos wallet only if the site asks. Line by line, before you say yes.

03

No one keeps access

The site gets a code that works once and dies in two minutes. No token, no refresh, no way back in without you.

04

A different you everywhere

Each site gets its own id for you, so two sites cannot line up their lists and find you in both.

What a site just received

That is the whole payload. PointCast.xyz asked as an ordinary site would. Run it again and sub stays the same here; on any other site it would be different.

Add it to your site

Paste the snippet. The button wires itself.
Someone taps it, sees your site's address and exactly what you will get, and says yes.
You receive { sub, card }. Store sub as their id on your site.

<script src="https://pointcast.xyz/connect.js" defer></script>

<button data-pointcast-connect data-scope="card">
  Continue with PointCast
</button>

<script>
  document.addEventListener('pointcast:connected', (e) => {
    const { sub, card } = e.detail;   // sub: stable for your site only
    console.log('Hello', card ? '@' + card.handle : sub);
  });
</script>

// Need your server to trust it? Ask for the code instead:
const { code } = await PointCast.connect({ exchange: false });
// …send code to your server, then from the server:
const res = await fetch('https://pointcast.xyz/api/connect/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ code, client: 'https://your.site' }),
});
const who = await res.json(); // { ok, sub, card, wallet?, aud, iss }

card: @handle, name, Noun, bio, now, place, song, up to three links, color. Always included when the person has one.
wallet: Ask with data-scope="card wallet". The person sees the exact address first.
sub: Stable for your origin, different on every other origin.
codes: One use, two minutes, only redeemable by your origin or your server.
modes: Popup by default; falls back to a full-page redirect when popups are blocked. Redirects only ever land on your own origin.
agents: /connect.json describes all of this as data.