One ID, many audiences.
Your identity is issued once; capability is granted per console. Compromising one audience token compromises one room, never the house.
The nervous system
One login, kept honest.
Identity is the one thing a platform cannot get half-right. Weke ID is the single issuer for all twelve surfaces — short-lived tokens, published keys, and a sign-in page that looks the same at every door because it is the same.
-
01
Sign in at the front door
wekelogin.com checks your credentials — with a second factor when your account asks for one — and issues a signed session.
-
02
The console gets its own token
Consoles that need a scoped credential exchange the session for an audience token naming exactly one app. A billing token opens nothing else.
-
03
Every service checks the keys
Verification is a public JWKS read — no shared secrets between consoles, no service trusting another service's word for who you are.
- Verified sign-ins
- JWKS baseline
Tokens expire; sessions refresh.
Access tokens live minutes, not months. The refresh dance happens quietly behind the console so the short lifetime costs you nothing.
Every door looks the same.
All twelve surfaces share one generated sign-in page — same fields, same errors, same aurora. A login screen that looks unfamiliar is the phishing tell.
At the door
The sign-in every console shares
The glass card over the aurora, the blueprint grid, the outlined W — generated from one template for all twelve surfaces, so the front door is always recognizable.
