> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aveid.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Ave

> Passkey identity, OAuth/OIDC, delegation, signing, and encrypted app-key delivery for modern apps.

Ave is a passkey-first identity platform built on OAuth 2.0 and OpenID Connect. It handles hosted sign-in, token issuance, refresh, delegated app access, identity-backed signing, and optional per-app encryption key delivery.

## Choose a path

<CardGroup cols={2}>
  <Card title="Quick Ave" icon="bolt" href="/guides/quick-ave">
    Add sign-in without registering an app. Use it for prototypes, internal tools, and the first version of an integration.
  </Card>

  <Card title="Registered OAuth" icon="key" href="/quickstart">
    Register an app when you need PKCE, refresh tokens, app branding, configured redirect URIs, or a confidential client.
  </Card>
</CardGroup>

## What Ave includes

<CardGroup cols={2}>
  <Card title="Convex integration" icon="database" href="/guides/convex-custom-auth">
    Use Ave as a Convex OIDC provider and keep Convex supplied with fresh ID tokens.
  </Card>

  <Card title="Connector delegation" icon="link" href="/guides/connector-app-to-app">
    Let one app request scoped access to another Ave-registered resource on a user's behalf.
  </Card>

  <Card title="Signing" icon="pen-nib" href="/guides/ave-signing">
    Request identity-backed Ed25519 signatures for approvals that need a verifiable user action.
  </Card>

  <Card title="End-to-end encryption" icon="lock" href="/guides/end-to-end-encryption">
    Deliver per-app, per-identity encryption keys without exposing plaintext key material to the server.
  </Card>
</CardGroup>

## Hosts

Ave uses separate hosts for sign-in, API calls, and organization administration. Keep the sign-in and API hosts separate in your integration.

| Host                         | Use it for                                                                        |
| ---------------------------- | --------------------------------------------------------------------------------- |
| `https://aveid.net`          | Sign-in UI, Connector consent, OIDC discovery, JWKS                               |
| `https://api.aveid.net`      | Token exchange, userinfo, signing, management, API calls                          |
| `https://business.aveid.net` | Business organization membership, org key grants, verified domains, and SSO setup |

<Warning>
  Send OAuth token exchanges to `https://api.aveid.net/api/oauth/token`. User-facing authorization pages stay on `https://aveid.net`.
</Warning>

## How to get started

<Steps>
  <Step title="Try Quick Ave first">
    [Quick Ave](/guides/quick-ave) gives you origin-based auth without a dashboard, client ID, or redirect URI setup.
  </Step>

  <Step title="Move to registered OAuth">
    [Quickstart](/quickstart) covers app registration, PKCE, token exchange, refresh tokens, and session creation.
  </Step>

  <Step title="Understand the tokens">
    [OAuth authorization code flow](/guides/oauth-authorization-code-flow) explains `id_token`, `access_token`, `access_token_jwt`, and refresh token rotation.
  </Step>

  <Step title="Pick your client model">
    Browser and mobile apps use [PKCE](/guides/pkce-for-public-clients). Server apps can use [confidential clients](/guides/server-side-confidential-clients).
  </Step>

  <Step title="Add advanced features when ready">
    Add [Connector delegation](/guides/connector-app-to-app), [Signing](/guides/ave-signing), [end-to-end encryption](/guides/end-to-end-encryption), or [Convex auth](/guides/convex-custom-auth) when your app needs them.
  </Step>
</Steps>