More ways to sign in.
One Hybrid-ID.

Existing account or new account?

• Existing Hybrid account: sign in normally, open Security & sessions, and connect a provider with fresh authenticator verification.
• Existing provider link: use that provider at Hybrid-ID sign-in. Hybrid’s own MFA and account restrictions still apply.
• New account: when enrollment is enabled, confirm a display name and accept the current terms. The verified external account becomes a sign-in method for the new Hybrid-ID.
• Matching email: we never silently combine identities. Sign into the existing account first, then explicitly connect the provider. Apple relay addresses are valid contact addresses; they are not evidence that two accounts belong to the same person.

For integrating applications

Continue using Hybrid-ID’s OIDC integration. Your application does not need Apple or Google credentials and should key users by the validated Hybrid issuer and subject, not email. Hybrid manages the upstream sign-in method.

Linked sign-in methods grant no extra profile, agent, wallet or spending authority. Existing application consent and scopes remain in force.

Optional explorer receipts

• Publishing is a separate, explicit action in Security & sessions and requires fresh verification.
• A receipt exposes the provider name and a randomized commitment. It does not expose your email, provider subject, or internal Hybrid identity identifier.
• Receipts expire after seven days. Withdraw and republish to renew. Disconnecting invalidates the receipt; reconnecting does not revive it.
• The explorer checks the issuer signature, document digest and a fresh signed status. A URL alone does not establish that its presenter owns the linked account.
• This is an issuer attestation of an account link, not KYC, endorsement by the external provider, or an on-chain transaction proof.
• Steam and other providers require their own verified adapter before they can issue receipts. Supplying an arbitrary ID or hash is not sufficient.

Management and verification routes

The first-party browser uses GET/POST /api/identity/federation with its secure Hybrid-ID session. Actions are begin, unlink, publish and withdraw. Writes require a fresh authenticator code; publication also requires publish_consent: true.

These are owner-portal operations, not third-party OIDC token APIs. Server-only Identity routes validate the management client, owner and purpose-bound authorization. Provider callbacks are browser-bound and single-use.

Public signed receipts: https://hybrid-chain.com/api/explorer/external-identities/RECEIPT_ID. Fetch trusted issuer metadata separately at https://hybrid-chain.com/api/explorer/identities/issuer; never trust a key supplied by a receipt presenter.

Disconnecting requires another usable sign-in method and revokes existing Identity sessions. External applications remain responsible for ending their own local sessions and rechecking credentials.