Identity plane

id.didi.sh

The service that issues the credential. One login across MemoPop AI, DidiDecks AI and Augment It — no passwords, ever.

Invite only Build

The contract

Consumers depend on three artifacts and nothing else. Changing any of them is a cross-service breaking change.

Session cookie
didi_session — EdDSA-signed, Domain=.didi.sh. Only this service mints them.
JSON API
id.didi.sh/api/* — headless. Consumer apps own their own sign-in pixels.
Public keys
/.well-known/jwks.json — verify with the public key; the signing key never leaves here.

Your surfaces

Redeem an invite Your keys What didi.sh is

Inspect

This page is the specimen. Hold it under each light.