What is Sigma Auth?

Sigma Auth is a hosted identity and authorization service built on Better Auth. People can create or import a Bitcoin identity, sign locally, select a BAP profile, and authorize an application. Developers receive OAuth tokens and identity claims and establish their own application sessions.

Three identifiers with different jobs

Do not use a display name, email address, or an arbitrary public key interchangeably with these identifiers. One account can have multiple BAP identities; a wallet identity key can differ from an OAuth application's registered signing key.

What the service provides

• OAuth authorization-code sign-in with S256 PKCE, OIDC claims, refresh, and revocation endpoints.
• Better Auth account sessions, email verification, configured social providers, passkeys, and two-factor settings.
• Encrypted backup storage and recovery through previously linked accounts.
• BAP profiles, connected wallets, and BSV 1Sat NFT ownership checks.
• Device authorization, scoped agent capabilities, and team/delegation interfaces.
• Certificate catalogs and wallet integration contracts with explicit rollout gates.

See the documentation index for each workflow and its availability limits.

Security boundary

Identity private keys and backup passwords are used locally for signing and encryption. The service stores encrypted backups, public identity data, user accounts, sessions, linked-provider records, and operational metadata. It also has service secrets of its own. This is not a claim that Sigma stores no personal data or that a compromised browser cannot steal keys.

An account password used by Better Auth's email sign-in is different from a local backup password. Resetting an account password does not decrypt a backup. Social sign-in can locate a linked backup and establish an account session; it does not supply the missing decryption secret.

Start with integration or account security.