No Passwords, No Pasted Keys: Secure Sign-In for AI Assistants

When we let people use Faydo from inside ChatGPT and Claude, one question sat above all the others: how do you connect an AI assistant to your account without making it either annoying or unsafe?

Faydo is a gift-card marketplace. Connecting an assistant means giving it the ability to see your account and, potentially, spend your money on discounted gift cards. That deserves the same care as any login — but it also has to feel effortless, or nobody will use it. This is the story of how we got there, including the one shortcut we deliberately refused to take.

Attempt one: generate a key, paste a key

The first version was the obvious one. You’d log in on faydo.in, click Generate Key, copy a long string, and paste it into your AI client’s settings. It worked. But it was clunky in a way that quietly matters:

• Friction. Copy-paste between a website and an app config is exactly the kind of step people abandon halfway.
• A credential that just sits there. A pasted key is a bearer token. If it ever leaks — a screenshot, a log, a shared config file — it’s a working credential until it expires.
• It expired at the worst times. Keys had a fixed lifetime and no automatic renewal, so connections would silently break days later.

It was serviceable, but it wasn’t good. We wanted “connect” to feel like signing in with Google — one tap, then you’re in.

The mistake we refused to make

There’s a tempting shortcut when an AI is involved: just let the assistant ask you for your login code. “What’s the OTP we texted you?” You type it into the chat, the assistant verifies it, done.

Never do this. The moment a one-time code is typed into a chat, it becomes part of the conversation transcript — stored, scrollable, and potentially retained. One-time codes are meant to be seen once, by you, and then vanish. Handing them to a model to read defeats their entire purpose.

So we set a hard rule for ourselves:

A login code must never enter an AI conversation. Sign-in happens on faydo.in, in your browser — never in the chat.

We removed every path that could have collected a code inside the assistant. Whatever we built next had to keep authentication off the model entirely.

The answer: OAuth 2.1, the same standard behind “Sign in with…”

The right tool already existed and is what serious platforms use: OAuth 2.1 with PKCE. If you’ve ever clicked “Continue with Google” and approved a permission screen, you’ve used it. We made faydo.in a proper authorization server so any MCP-capable assistant can use that exact flow.

Here’s what it feels like now:

1. You add Faydo to your AI client.
2. The client opens faydo.in in your browser. You sign in there — the way you always do, with the code entered on our page, never in the chat.
3. You see a clear consent screen: “This app wants to browse brands and make purchases on your behalf.” You tap Allow.
4. You’re connected. No keys, nothing to copy.

And underneath, several things are working to keep it safe:

• PKCE protects the exchange so that even if a network request were intercepted, it couldn’t be replayed to steal access. (AI clients are “public” apps that can’t keep secrets, so this protection is essential — and mandatory in our setup.)
• Explicit consent. Access is only ever granted by you tapping Allow on our page — never silently.
• Short-lived access that renews itself. Your assistant holds a short-lived token and quietly refreshes it in the background, so the connection stays alive without a long-lived secret sitting around.
• Revoke anytime. Remove the connector in your AI client and the access is gone.

Why the boring, standard choice was the right one

It would have been faster to keep hand-rolling our own key scheme. But authentication is precisely the place where “clever and custom” is a liability and “standard and battle-tested” is a feature. OAuth 2.1 gave us a flow users already recognise, a security model that’s been scrutinised for years, and — the part we cared about most — a clean way to keep every one-time code out of the AI’s reach.

The result is the thing we wanted from the start: connecting Faydo to your assistant now feels like a normal sign-in — one tap, approve, done — while the actual security is stronger than the key-paste approach it replaced. Effortless on the surface, careful underneath. That’s the standard we hold every part of Faydo to, and account connection is no exception.