Passpage protocol
Pre-launch
Join early access

Stop re-typing yourself into every new app.

Passpage is a consent layer between people and apps. Save your details once, authorize what's shared field by field, revoke anything anytime, and developers skip building onboarding forms entirely.

Join early access See how the handshake works

No live signup yet. This reserves your spot for launch.

Passpage
F
FoodApp (demo) wants to complete your account setup.
Personal Profile
sachin@example.com
Switch
Requested information
Full name
Sachin R.
required
Email
sachin@example.com
required
Delivery address
Home: 104, Green Park…
optional · on
Redirected to FoodApp with 2 approved fields

For developers

Drop in a popup instead of a signup form. One request tells Passpage what you need. The rest is a redirect and a server-to-server exchange.

// trigger the handshake
window.open(`https://passpage.id/authorize?
  client_id=${CLIENT_ID}&
  required_scopes=profile:name,profile:email`)
Required vs. optional scopes: declare what you truly need, request the rest as optional.
Exact-match redirect URIs: no substring matching, validated server-side on every request.
Usage analytics: request volume, success rate, and response time per app, from day one.

For individuals

Save your name, email, and addresses once. Group them into named profiles, like "Work" or "Shopping," and hand apps only what you choose to.

Named profiles: bundle a contact card with an address, reuse it across every app that asks.
Field-level consent: see exactly what's required versus optional before you authorize anything.
Full history, one revoke button: every app you've authorized, what they got, and when.
Join early access →

How the handshake works: three steps, the same shape as the OAuth you already trust.

Passpage doesn't replace sign-in. It sits alongside it, moving structured data instead of authenticating identity.

01

Authorize

The app opens a Passpage popup naming which fields it needs and which are optional. You pick a saved profile, review the fields, authorize.

POST /authorize → authorization_code
02

Redirect

Passpage redirects back to the app with a short-lived, single-use code. Nothing else travels in the URL.

302 → redirect_uri?code=...
03

Exchange

The app's backend trades the code plus its own secret, server-to-server, for exactly the fields you approved. Nothing more.

POST /exchange → { profile }

What revoking access actually does

Revoking stops an app from receiving anything further and closes off any still-active grant — same as revoking access in any OAuth-style system. It can't delete data an app already received before you revoked. That's governed by the app's own privacy policy, not Passpage's.

Get early access

Passpage isn't public yet. Terms of Service and Privacy Policy are still being finalized. Leave your email and you'll hear the moment it opens.

You're on the list. We'll email you at launch.

Built in public by OuterCircle Labs. No spam, one email when it's ready.