# Choose how visitors sign in

Let visitors sign in to your public site with a Median account, your own app, or an OpenID Connect provider.

Signing in lets visitors post, vote, comment and follow on the feedback
board, and keeps their support chat across devices. The help center never asks.

| Method | Visitors sign in with | Setup | Same customer as the widget |
| --- | --- | --- | --- |
| **Median accounts** | A free Median account | None | No. Matched by email address |
| **Your app** (recommended) | Their account in your product | One route in your app, added by your developer | Yes |
| **OpenID Connect** | Your identity provider, like Auth0 or Okta | The provider's details | When your widget signs the same `sub` |

Pick one under **Site → Sign-in**. Admins and owners only. Switching signs
out everyone who signed in another way.

## Median accounts

The default. There is nothing to set up.

| Fact | Detail |
| --- | --- |
| What visitors see | **Sign in to Acme** on median.sh, with **Continue** and **Cancel** once they are signed in to Median |
| Not signed in to Median | **Continue** opens Median's sign-in page, where they sign in or make a free account, then come back to approve |
| What you get | Their name, email and picture |
| Chat history | Joins whatever that email address sent you before, like email to your support address |

## Your app

Visitors sign in with the account they already have in your product. Their
site chat and their widget chat are one history.

1. **Add the route**

   Your developer adds one route to your app. It is the same route the
   widget reads to know who is signed in. See
   [Site sign-in](https://docs.median.sh/site/sign-in#your-app) in the
   developer docs.

2. **Paste its URL**

   Under **Site → Sign-in**, pick **Your app**, paste the route's full https
   URL, and press **Use your app**.

3. **Try it**

   Open your site and press **Sign in**.

## OpenID Connect

1. **Create an app at your provider**

   A regular web application using the authorization code flow. Add the
   **Redirect URI** from **Site → Sign-in** to its allowed callback URLs:
   `https://api.median.sh/sites/oidc/callback`. Allow the `openid`, `email`
   and `profile` scopes.

2. **Add its details**

   Pick **OpenID Connect**. Enter the issuer URL, client ID and client
   secret, and press **Use OpenID Connect**.

| Provider | Issuer URL |
| --- | --- |
| Auth0 | `https://<tenant>.<region>.auth0.com` |
| Okta | `https://<org>.okta.com`, or a custom authorization server's URL |
| Clerk | Your Frontend API URL. Turn on the `openid` scope on the OAuth application |
| Google | `https://accounts.google.com` |
| Microsoft Entra ID | `https://login.microsoftonline.com/<tenant-id>/v2.0` |

| Fact | Detail |
| --- | --- |
| Issuer | Checked when you save. The provider has to call itself by the issuer you entered |
| Email | Required. A visitor whose provider says the email is not verified is refused |
| Client secret | Never shown again. The page shows its last 4 characters. Leave it blank to keep it |
| New client | Enter the secret again when the issuer or client ID changes |
| Same customer as the widget | When your app signs the widget's user with the same id the provider gives them |

The protocol details are in
[Site sign-in](https://docs.median.sh/site/sign-in#openid-connect) in the
developer docs.

## What signing in does

| Where | Signed in | Signed out |
| --- | --- | --- |
| Header | Their picture or initial, with **Sign out** | **Sign in**, when Support or Feedback is on |
| Feedback | Post, vote, comment and follow. A vote, follow or comment pressed before signing in goes through after, and a post reopens with its draft. Images have to be attached again | Read only |
| Support | The chat follows them across devices, with no email prompt. With your app or OpenID Connect it is the widget's history too, and your tools know who they are | The chat belongs to this browser. With your app or OpenID Connect, the agent can put a **Sign in** button under a reply when one of your tools needs to know who they are, and the foot of the history offers **Sign in** beside **Email a code** |
| Help center | No change | No change |

| Fact | Detail |
| --- | --- |
| Session | 30 days |
| Sign out | Ends the session and starts a fresh chat in that browser |
| Before signing in | Anything the visitor said in the chat joins their signed in history |
| Addresses | Works on `<slug>.median.website` and a live [custom domain](/articles/use-your-own-domain) |
| Time limit | A sign-in has 15 minutes to finish |

## Troubleshooting

What visitors and the dashboard can say, and what to do about it, is in
[Fix public site problems](/articles/fix-public-site-problems#sign-in).