What is happening

  1. This app sends you to Aadhiwith a one-time secret (PKCE) and, if you picked one, the sign-in strength it needs.
  2. Aadhi signs you inwith your password, authenticator app or passkey, and checks the sign-in for risk.
  3. You come back with a codethat only this browser can swap for tokens, because only it knows the secret.
  4. The app reads the ID tokento learn who you are and how you signed in. It never sees your password.

This page is a static site with no server and no client secret. It identifies itself to Aadhi with a client metadata document, so it did not need to be registered by hand.