Proof, in the file.

• Keep the image source on `receiz.com`.
• Badge clicks should use a record-specific /v/{{slug}}/{{code}}/{{pulse}}?a={{anchorId}} link when available (fallback: /verify).
• Keep assetUrl as your own app route to the original asset bytes; do not point it to receiz.com.
• Use the badge where proof matters: near payout/original evidence, not decorative-only locations.

{
  "assetId": "asset_93f42",
  "assetTitle": "Invoice #4082.pdf",
  "assetUrl": "https://app.example.com/assets/asset_93f42/original",
  "receizVerifyUrl": "https://receiz.com/v/{{slug}}/{{code}}/{{pulse}}?a={{anchorId}}",
  "badgeSrc": "https://receiz.com/powered-by-receiz.svg"
}

// UI wiring:
// - Primary file/open button -> payload.assetUrl (your app asset route)
// - Powered by Receiz badge -> payload.receizVerifyUrl (fallback: https://receiz.com/verify)

Add a branded Sign in with Receiz button and start OIDC + PKCE for passkey-first sign-in, magic-link fallback, and automatic account creation.

Need the full architecture and identity contract? Open Receiz Connect Guide.

Rendered Preview

Use /sign-in-with-receiz.svg on light UIs and /sign-in-with-receiz-light.svg on dark UIs.

<button id="receiz-signin" type="button" class="receiz-signin-trigger">
  <img src="https://receiz.com/sign-in-with-receiz.svg" alt="Sign in with Receiz" width="240" height="44" />
</button>

<style>
  .receiz-signin-trigger {
    border: 0;
    background: transparent;
    padding: 0;
    line-height: 0;
    cursor: pointer;
  }
  .receiz-signin-trigger img {
    display: block;
    width: 240px;
    height: 44px;
  }
</style>

<script type="module">
  // Exact flow:
  // 1) Build PKCE (verifier + S256 challenge)
  // 2) Redirect to https://receiz.com/api/oidc/authorize
  // 3) Exchange code at token endpoint from discovery
  // 4) Upsert your user by OIDC subject (profile.sub)
  // Receiz login behavior:
  // - Passkey first, magic-link fallback
  // - Auto-provision account for new users
  // - Passkey and email resolve to one stable Receiz identity
  // - No password storage/reset flows required in your app
  document.getElementById("receiz-signin")?.addEventListener("click", () => {
    // start PKCE + OIDC redirect
  });
</script>

• Passkey-only onboarding for new users, with no email required at first sign-in.
• Seamless email sign-in available at any point, resolving to the same Receiz user identity.
• Existing email-first users can add passkey later, and passkey-first users can add email later, without identity split.
• Automatic Receiz account provisioning on first successful login from your app, for passkey or email.
• Recipient magic-link flows can provision users in-line; afterward passkey and email both access the same account.
• No passwords, no credential tables, and no password-reset support burden in your product.
• Stable OIDC subject mapping (`sub`) so your local user records never split across login methods.
• Standard OIDC/OAuth stack plus optional delegated Receiz action scopes for record/seal/verify APIs.