Software KC OAuth Terms and Conditions

Last Updated: 10/29/2026

Software KC OAuth is a hosted sign-in service from Software KC, LLC ("Software KC," "we," or "us"). These terms add to our Product Terms and Conditions, which apply to every product we sell directly. If these terms and the Product Terms disagree, these terms apply for Software KC OAuth. How we handle information in Software KC OAuth is explained in the Software KC OAuth Privacy Policy and our Product Privacy Policy.

These terms are written for the developers and companies that integrate Software KC OAuth into their own applications. The people who sign in to your applications are covered by your terms, not these.

1. What Software KC OAuth Provides

Software KC OAuth handles authentication for your applications, so you don't have to build it yourself. Your application implements a single OAuth endpoint that confirms a user has signed in. We handle the rest:

  • Registration and sign-in through the login methods you allow for each application: Google, Microsoft, any other OAuth provider you configure as a custom provider (for example Apple or Meta), and built-in user name and password.
  • For user name and password sign-in: password storage, which is always hashed, and two-step verification with an authenticator app (TOTP).
  • Several accounts signed in at the same time, the way Google and Microsoft products work.

We use the same service to sign people in to our own products.

2. Roles

  • You are the subscriber: the developer or company that sets up applications in Software KC OAuth.
  • End users are the people who register and sign in through your applications.
  • End-user accounts belong to your subscription. They're separate from every other subscriber's accounts: a person who registers through your applications has an account with you, not one shared with other subscribers.
  • We provide sign-in on your behalf. Your relationship with your end users, including support, is yours.

3. Your Responsibilities

  • Validate sign-ins correctly. Your endpoint must verify each sign-in following the OAuth standard before giving anyone access. We can't protect your application from a sign-in it doesn't check.
  • Protect your credentials. Keep your client secrets, API keys, and the user secrets your application receives confidential. If you think one has been exposed, replace it and tell us right away at hello@softwarekc.com.
  • Configure your applications carefully. You choose which login methods each application allows and which redirect addresses it uses. Only use redirect addresses you control.
  • Tell your end users. Provide your own terms and privacy policy for your applications, explain that sign-in is handled by a service provider, and get any consent the law requires.
  • Use it lawfully. Don't use Software KC OAuth to impersonate another service, collect sign-in details under false pretenses, or get around another provider's rules.

4. Login Providers

  • You supply your own configuration for each login provider, including the API keys and client IDs you get from Google, Microsoft, or a custom provider. Your account with each provider, and following its terms, is your responsibility.
  • A custom OAuth provider is your choice. We pass along what it returns, but we aren't responsible for its security, availability, or behavior.
  • Features a provider offers, such as biometric sign-in or its own security checks, are provided by that provider under its terms.
  • If a provider changes or stops its service, sign-in through that provider may stop working until the configuration is updated.

5. What Your Application Receives

When an end user signs in, your application receives the standard OAuth response. Your application can also request the end user's name, user secret, and client user secret. Treat these secrets like passwords: store them securely, use them only to run your application, and never expose them to other users or other services.

6. Availability

  • We work to keep Software KC OAuth reliable and available on a best-effort basis. We don't currently offer a service level agreement or guaranteed uptime.
  • If Software KC OAuth is unavailable, your end users may not be able to sign in to your applications. Plan for that in how you use it.
  • Where practical, we'll let you know in advance about planned maintenance that could interrupt sign-in.
  • The limits on our liability in the Product Terms apply, including for interruptions to sign-in.

7. Security Incidents

Tell us right away if you suspect your applications or credentials have been compromised. If we learn of a security incident that affects your end users' information, we'll notify you without undue delay, and as the law requires, so you can inform your end users.

8. Subscriptions

Software KC OAuth is billed by subscription, as described in our Product Terms.

9. Ending Your Subscription

  • When your subscription ends, your applications can no longer sign users in through Software KC OAuth.
  • We then delete your applications' configuration and your end users' accounts within a reasonable period, as described in the Software KC OAuth Privacy Policy.
  • If you plan to move your end users to another sign-in system, contact us before you cancel and we'll help where we can. Passwords are stored hashed, so they can't be exported in readable form.

10. Contact Us

Questions about these terms? Reach us at: