Private
Your app can ask for a person's name, Pulse number and email, and nothing more. They see the request on a consent screen and choose Allow or Cancel. You get daily sign-in counts, never a list of who signed in.
PulseID for Developers
Sign-in without the surveillance.
Add Sign in with PulseID to your app. Your users bring the account they already have, and your app gets their name and email. It gets nothing else.
PulseID
ByteSizedBites wants access to your PulseID
ByteSizedBites Unverified app
WarPulse has not verified this app. Only continue if you trust bytesizedbites.example.
If you allow it, ByteSizedBites can:
- Confirm who you are
- See your name and Pulse number
- See your email address
AllowCancel
Simple
PulseID speaks standard OpenID Connect. Register an app and you have working credentials at once. Use any OIDC library, or make the few requests yourself: the docs show them with no SDK.
Secure
People sign in with a passkey, or with a password that always comes with an authenticator app. PKCE is required for every app. Client secrets are stored hashed, and a rotated secret can stay valid beside its replacement for up to 7 days.
How it works
Create an organization
Sign in with your PulseID account and name your organization. You are its owner, and you can invite admins and developers.
Register an app
Give it a name, a homepage and its redirect URIs. You get a client id and, for a web app, a secret.
Add the button
Put a Sign in with PulseID button in your app that starts an authorization code flow with PKCE. Everything it needs is in the discovery document.
Discovery URLhttps://id.warpulse.com/.well-known/openid-configuration
Unverified and verified
An organization is unverified until WarPulse staff verify it. You send your legal name, country and documents, and staff review them. The web apps of a verified organization can ask for more.
| What | Unverified | Verified web app |
|---|---|---|
| State | Unverified | Verified |
| Scopes | openid profile email | openid profile email offline_access |
| Refresh tokens | No refresh tokens | Yes, when the app asks with prompt=consent |
| Consent screen says | WarPulse has not verified this app. | Verified by WarPulse. The legal name and country are shown. |
Public apps (no client secret) never get refresh tokens, verified or not.