Docuity ID
The one account behind every free Docuity app — sign in once with a passkey, and losing a device or a staff member never means chasing down separate logins.
- 1 login
- works across every app in the suite
- Passkeys first
- Face ID, Touch ID, or a security key
- Instant revoke
- sign out one device or all at once
The problem
Every app in the Docuity suite needs sign-in, but nobody wants a separate login for each — and a separate place a password could leak. Docuity ID is the one account behind all of them, part of the Docuity healthcare suite.
What it does
Docuity ID is free, like every app in the Docuity suite, and it's the one account behind all of them — records, prescriptions, chat, the patient-owned record, the rota tool. Sign in once, with a passkey (Face ID, Touch ID, or a security key) instead of a password, and every app recognizes you immediately, with no separate login.
The account page is a full self-service center: add or remove passkeys, turn on an authenticator app as a second step, see every device currently signed in with when and roughly where, sign one device out or sign out everywhere at once, download everything the account holds, or delete the account outright.
Nothing sensitive changes without confirming it's really you again — removing a passkey, changing an email or password, or deleting the account all ask for a fresh sign-in first, even mid-session.
Key features
One passkey, every app
Sign in once with a fingerprint or face scan and every Docuity app already knows who you are — no separate password to create, remember, or leak, for each one.
Turn someone off everywhere, instantly
When a staff member leaves or a device is lost, revoking access in one place locks them out of records, prescriptions, chat and the rest right away — not eventually.
See every place you're signed in
A plain list of every active session — which device, roughly where, last seen when — so nothing stays logged in that shouldn't be.
A second step when you want one
Anyone who wants an authenticator-app code on top of a password can turn it on, for accounts or devices that don't use a passkey.
Nothing changes without proving it's you again
Removing a passkey, changing an email, or deleting the account all ask you to confirm you're really you, even mid-session — so a laptop left unlocked for a minute can't quietly take the account over.
Your data, exportable or deletable
Download everything the account holds, or delete it outright — the account isn't a black box you can't get back out of.
Where it stands
Built for the Docuity apps themselves; letting an outside company's app sign in with a Docuity account is a later step, not something it does today.
Under the hood — for the technically-minded
How it's built
Docuity ID is the only place any app ever asks for a credential. It issues a signed token the moment you sign in, and the other apps verify that token themselves rather than asking ID to vouch for every single request — so the suite stays fast even if one app is busy. ID also keeps a live, checked switch that can invalidate any token the instant you sign out or revoke a device, so speed and instant revocation don't trade off against each other.
Passkeys are offered first everywhere sign-in happens, with a password and an emailed link kept as fallbacks for people or devices that don't support them. Every app in the suite, new or existing, plugs into the same shared account library rather than rolling its own login.
The hard problems
Fast everywhere, revocable instantly — normally a tradeoff
Signing a token so every app can check it locally, instead of phoning home on every click, is what makes cross-app sign-in feel instant. The usual cost of that approach is that revoking access has to wait for the token to expire on its own. Docuity ID closes that gap with a live, checked-on-every-request switch, so 'log out everywhere' takes effect immediately instead of eventually.
A second sign-in required before anything sensitive
Ordinary browsing is never interrupted, but removing a passkey, changing an email, or deleting the account all require a fresh sign-in first — so a device left unlocked for a minute isn't enough to take the account over.
One account, cleanly linked, never force-merged
Each app keeps its own local profile and only links it to a Docuity account when the email genuinely matches and is verified — an unverified email is never trusted to merge two identities together.
Built with
- React Router 7
- Drizzle
- Postgres
- Redis
- Passkeys
Building something in this space?
Work with us →