One connector,every way to sign in.
CZL Connect folds GitHub, Google, QQ, WeChat, Discourse and passkeys into one standard OIDC sign-in. Account security, user groups, broadcasts, app push, release downloads and live chat after sign-in all live in the same console.
More than sign-in: a full app back office
Integrate OIDC once and everything below comes with your users' accounts.
Unified sign-in
GitHub / Google / QQ / WeChat / Discourse merged into one account, exposed as standard OAuth2 + OIDC
Account security
Passkeys, sign-in history with IP risk, email verification and changes
App management and open API
Group permissions, app stats, audit logs, and an app-level API for your backend
Email and release downloads
Broadcasts, verification codes and custom emails; distribute GitHub Releases from fixed URLs with an auto-update manifest
App push
Turn Web Push and your backend's messages into iOS notifications, end-to-end encrypted
Live chat
Site widget, verified visitors, two-way WeCom replies, and a cross-app inbox
Analytics
One script to track visitors, referrers, pages and devices, no cookies
Integrate once, support every sign-in method
Whether someone arrives via GitHub, Google, QQ, WeChat, Discourse or a passkey, it is the same account. You only deal with one standard OAuth2 / OIDC surface, so off-the-shelf client libraries just work.
- Authorization Code + PKCE. Public clients such as SPAs need no secret and must use S256
- OIDC Discovery and JWKS, with ID Tokens signed using RS256
- prompt=none silent authentication restores signed-in users' sessions without any interruption
- upstream_providers limits the sign-in page to the methods you specify
- Sliding refresh_token renewal keeps active users from being signed out overnight
GET /oauth2/authorize?
client_id=client_xxxxxxxxxxxx
&response_type=code
&scope=openid profile email
&code_challenge_method=S256
&upstream_providers=github,wechat
&prompt=none
# Signed in and already authorized → redirect back with a code
302 https://your-app.com/callback?code=…&state=…
# Cannot complete silently → redirect back with an error, no sign-in page
302 https://your-app.com/callback?error=login_requiredAfter sign-in, we keep watching the account
Users manage their sign-in methods and security details in account settings. Sensitive actions are backed by passkeys, and suspicious sign-ins stand out at a glance.
- Passkey (WebAuthn) quick sign-in, with re-verification for sensitive actions
- Sign-in history records location and risk per IP: Tor, proxy / VPN, hosting providers
- QQ / WeChat sign-ins must add and verify a real email first, so no placeholder-email accounts
- Verified users can change their email themselves, verifying both the old and new address
- Admins can block a single IP or a CIDR range, with automatic expiry
- Safe203.0.113.24Shanghai · China Telecom · WeChat
- Suspicious198.51.100.7Singapore · Hosting provider · GitHub
- High risk192.0.2.180Germany · Tor exit · Passkey
Users, groups and data, manageable from the console and the API
Each app manages its own users and groups. Most of what the console can do, your backend can also do programmatically through the app-level API.
- In-app groups t0–t5 / viewer / admin, delivered as a JSON array in groups via the ID Token and userinfo
- App stats: authorizations, active users, MAU trends
- App-level API: look up users, change groups, disable and sign out users, pull authorization events
- Keys are scoped and stored hashed. When rotated, the old key keeps working for a 24-hour grace period
- Auth logs and audit logs are recorded separately, with retention growing by plan
# Change a user's group (scope: group:write)
curl -X PATCH \
-H "Authorization: Bearer czlc_live_xxx" \
-d '{"group":"t3"}' \
https://connect.czl.net/api/v1/app/users/1001
# On the user's next sign-in, in the ID Token / userinfo:
{
"sub": "1001",
"email_verified": true,
"groups": ["t0", "t1", "t2", "t3"]
}Notify users and ship installers without standing up another service
Two chores integrators usually have to build themselves, done directly with the data already in your app.
- Broadcasts: Markdown body, recipients filtered by in-app group, with optional external emails
- Email API: send verification codes to any address and let CZL Connect verify them, and send custom HTML emails to your app's users
- One-click unsubscribe (RFC 8058), automatically skipping unsubscribed, unverified and banned users
- Release downloads: GitHub Releases (private repos included) served from stable /dl/ URLs
- latest.json auto-update manifest, with asset URLs pinned to a version and sha256 included
- Public download page recommends the right installer for each visitor, with download counts per alias
{
"tag": "v1.2.3",
"aliases": {
"windows-x64": {
"sha256": "9f2c1a…",
"url": ".../dl/myapp/v1.2.3/windows-x64"
}
}
}Notify your iOS app without running a push service
Servers that only speak Web Push (such as a mail server's JMAP push) and your own backend can both reach users' iOS devices through CZL Connect. Content is end-to-end encrypted; only ciphertext passes through.
- Web Push (RFC 8030) is relayed to APNs, with one stable push URL per device
- RFC 8291 end-to-end encryption; your app's notification extension decrypts on the device
- Push per user via the app API: bind devices, list devices, send in batches with a result for each message
- One Apple push key (.p8) shared by all apps in your account, connection-tested before saving
- Messages are held until activation to support subscription verification (e.g. JMAP); dead devices are cleaned up automatically
{ "messages": [
{ "subscriptionId": "sub_a1…", "payload": "<ciphertext>" },
{ "subscriptionId": "sub_b7…", "payload": "<ciphertext>" }
] }
# Per-message results
[ { "subscriptionId": "sub_a1…", "status": "sent" },
{ "subscriptionId": "sub_b7…", "status": "gone" } ]Website support, live with one script
Embed a support widget on your site and visitor messages land in your inbox in real time. Bind a WeCom smart bot and agents can reply by quoting messages right inside WeCom.
- A bottom-right widget, or bind any button on your page with data-czl-support
- Pre-chat form: name, email, phone and message, each optional or required
- Verified visitors: your backend issues an identity token, so profiles are locked and history follows them across devices
- Send and receive images and files in chat; replies go out by email when the visitor is offline
- Two-way forwarding through a WeCom smart bot, with conversations from all apps in a single inbox
How many people visit, where they come from, what they read
Add one script to your site and visitor data shows up in the app console. No cookies, no stored visitor IPs, and no cookie consent banner needed.
- Visitors, visits, page views, bounce rate and average visit duration, compared with the previous period
- Pages, entry pages and exit pages, plus referrer domains and channels (search, social, referral, ads)
- Browser, OS and device, country and city maps, and a weekday × hour heatmap
- Automatic SPA route tracking, with custom events and UTM campaigns
- Shareable count badges for daily, monthly and total visitors and per-page views, ready to paste into a README
- /1,284
- /pricing642
- /docs/start389
Three requests and your app has an identity system
Standard Authorization Code + PKCE. One client_id covers every sign-in method.
Create an app
Create an app in the console, set the callback URL and the scopes you need, and get your credentials right away
client_id = client_xxxxxxxxxxxx
client_secret = **** # not needed for SPA-only apps
redirect_uri = https://your-app.com/callbackRedirect to authorize
Send the user to the authorization endpoint using standard Authorization Code + PKCE. Add upstream_providers to limit sign-in methods.
GET /oauth2/authorize?
client_id=client_xxxxxxxxxxxx
&redirect_uri=https://your-app.com/callback
&response_type=code
&code_challenge_method=S256
&code_challenge=...Exchange the code for the user
Exchange the code for an access_token / id_token, then call userinfo to get the user's identity. Read the optional groups if you need tiers.
POST /api/oauth2/token
→ { access_token, id_token, refresh_token }
GET /api/oidc/userinfo
→ { sub, email, email_verified,
groups: ["t3"] } # optional, ignore if unusedAvailable sign-in methods
Users sign in with accounts they already have. New methods need no changes in integrated apps.
Start free with Lite, upgrade when you need to
Sign-in and account security are included in every plan. Broadcasts, release downloads, app push, live chat and analytics start at Plus. Billed in CNY, with credit card and Alipay.
Now,
leave sign-in to us
Create an app, set your callback URL, and your users can sign in with GitHub / Google / QQ / WeChat / passkeys.