This is a WordPress site, and every person who signs in to it does so through Authfu. The blog you are reading is the first customer of the plugin it writes about.
The plugin
The Authfu plugin for WordPress connects this site to Authfu with OpenID Connect. It uses the authorization code flow with PKCE, verifies every ID token against Authfu’s published signing keys, and links each WordPress account to a stable Authfu subject rather than to an email address that might change hands. It speaks the protocol using the HTTP and cryptography tools WordPress already ships, so activating it is the whole install.
How you sign in
Open the sign-in page and choose Continue with Authfu. From there, pick whichever door suits you: Google, Microsoft, GitHub, a passkey, or an emailed link. If your account has two-factor authentication turned on, Authfu asks for your code before it sends anything at all. A valid code comes first; the link follows. Then you are back here with a WordPress session and the role Authfu assigned to you.
Roles come from Authfu
Each sign-in carries a roles claim, and the plugin maps administrator, editor, author, contributor, and subscriber one-to-one onto WordPress roles. Assign a role in Authfu and it is applied the next time that person signs in. One place to decide, every site in step.
Sessions end when access does
When someone’s access is revoked in Authfu, Authfu sends a signed back-channel logout token to this site, and WordPress destroys every session for that person, on every device, immediately. As a backstop, the plugin also confirms access with Authfu on a short cadence, so a missed message is caught within minutes.
Why we run it this way
Because using Authfu on our own front door is the honest way to learn what it feels like. The settings screen, the role sync, the moment a session ends: we live with all of it here first. Read more in why we sign in to our own blog with Authfu, or set it up on your own site with Passwordless WordPress in five minutes.