Add Key sign-in to your site

Two different things

Your setup, once

You, the site's owner, sign in to Key once and allow it to make an app for your site. That gives your site its own sign-in. You do it once per site, and again only if you need a new secret key.

Your visitors, every time

Your visitors never do the setup. They click your site's Sign in button, type the code Key emails them, and they're back on your site, signed in. If you're clicking Sign in on someone's site, you're a visitor, not setting anything up.

The one-time setup

An app is your site's entry in Key: its name, its colours, and the addresses Key may send a visitor back to.
Start the setup from the computer you manage your site from: it opens Key's sign-in in your browser. Sign in with the code sent to your email.
On the next page, tick both boxes, "apps:write" and "keys:write", and allow. Key leaves the second one unticked on purpose; without it no secret key can be made.
You give Key two return addresses (where a visitor lands after signing in, and after signing out). Key registers them, and makes the app's id and a secret key.

Where each value goes

The app id

It starts with app_ and is public. Put it in your site's settings as its client id.

The secret key

Save it in your password manager first, then in your host's secret settings, never in your code. Key shows it once. If it's lost, make a new one and revoke the old one.

How to tell it worked

Open your site's sign-in link. It should take you to Key's sign-in page, not an error.

What your visitors get

Signing in is optional. A visitor can use your site without it.
Signed in, they're the same person on every device, so your site can keep their name and progress with them.
The steps: Sign in, the code from their email, and back where they were.
Key keeps no passwords, and your site never sees their email unless you ask for it.