Advanced Cubid Paths

# Advanced Cubid Paths

IAH keeps the default quickstart focused on human verification. When an app needs more than "verify this user," use Cubid infrastructure directly.

## Use IAH First For

- hosted human verification
- verification status checks
- verification webhooks
- basic app setup and monitoring

## Bridge To Cubid For

### Sign in with Cubid

Use this when verification should become the app's login or identity-provider flow, not just a gated proof step.

Consumer apps should start OIDC at Cubid's authorization endpoint, `https://id.cubid.me/authorize`, and request passkey assurance with `acr_values=urn:cubid:acr:passkey`. The Cubid issuer then redirects the browser to the Cubid-hosted `login.cubid.me` interaction surface, where Cubid creates or authenticates the user's passkey, gathers consent for the app-scoped identity information, and redirects back to the consuming app's OIDC callback. The consuming app should not implement its own Cubid passkeys.

`@iah/browser` exposes `createSignInWithCubidPkceRequest()` for this advanced bridge while keeping the default IAH quickstart focused on hosted human verification. Store the returned `codeVerifier` in same-origin browser storage or a server-side session, then exchange the authorization `code` on your callback with that verifier. If your app already manages PKCE, pass your own `codeChallenge` to `createSignInWithCubidUrl()`.

### App-Scoped Selective Disclosure

Use this when an app needs explicit consent records for which claims or proof values are shared with that app.

### Passkey-Required Verification

Use this when a higher-risk flow needs stronger assurance than email-link or lightweight proof completion.

### Custom Proof Policies

Use this when an app needs custom thresholds, proof depth, allow/deny rules, or operator-managed policy beyond the default IAH verification path.

### Chain And Custody Features

Use this when an app needs Cubid-managed accounts, wallet integrations, signing flows, custody, or chain-specific helpers.

## Product Rule

If the developer is trying to verify users quickly, keep them in IAH. If the developer is adopting identity, consent, custody, or protocol infrastructure, hand them to Cubid.