Sign in as a StartX company

A sign-in button for your app

Download the image or use its public URL. Connect the button to your app's OAuth start route; a static image is not a complete sign-in integration.

Light SVG ↓

HTML embed

Button HTML HTML

<a href="/auth/trustedrouter">
  <img
    src="https://trustedrouter.com/static/sign-in/startx-light.svg"
    width="360" height="88"
    style="max-width: 100%; height: auto"
    alt="Sign in with StartX. Backed by TrustedRouter / Google."
  >
</a>

Dark SVG ↓

HTML embed

Button HTML HTML

<a href="/auth/trustedrouter">
  <img
    src="https://trustedrouter.com/static/sign-in/startx-dark.svg"
    width="360" height="88"
    style="max-width: 100%; height: auto"
    alt="Sign in with StartX. Backed by TrustedRouter / Google."
  >
</a>

“Backed by TrustedRouter / Google” describes the authentication flow, not a funding relationship or endorsement. Your app checks the verified company-domain claim after sign-in.

Add it with your agent

Paste this into Claude Code, Codex, or your preferred coding agent.

Integration prompt

Add "Sign in with StartX" to this app using TrustedRouter. Follow the guide and use its button image: https://trustedrouter.com/sign-in-as-startx

One sign-in flow. Extra company context.

1. Register your app

   Sign in to TrustedRouter and register your app through POST /v1/oauth/apps with its name, app ID, and exact callback URL. Registration uses your console session, not a provider API key.

   OAuth registration and protocol reference

2. Request profile access

   Use the authorization-code flow with PKCE S256 and state validation. Request profile; add inference only if your app also calls models. The user approves access.

3. Read the current identity

   Exchange the code and fetch /v1/auth/userinfo server-side with the returned access token. Use data.sub as the stable user ID. Do not trust profile JSON sent by the browser.

4. Match the organization

   Require a verified email and an exact funding_organization match. Show the company and its source. Recheck current claims before granting company-only benefits.

Read company context JavaScript / server

// Server-side, after the OAuth code exchange.
// accessToken comes from TrustedRouter, not a browser claim.
const response = await fetch(
  "https://trustedrouter.com/v1/auth/userinfo",
  {
    headers: { Authorization: `Bearer ${accessToken}` },
    cache: "no-store",
  },
);
if (!response.ok) throw new Error("TrustedRouter profile unavailable");
const { data } = await response.json();

const company = data.email_verified === true
  && Array.isArray(data.company_affiliations)
  ? data.company_affiliations.find((claim) =>
      claim.funding_organization === "StartX"
      && claim.match_method === "verified_email_domain")
  : undefined;

// No match does not prevent ordinary sign-in.
const userId = data.sub;
const companyContext = company ?? null;

This runs after your OAuth callback. A missing match is null, not a failed login.

What your app receives

Company + domain

The listed company name and exact verified email domain.

Organization

funding_organization: "StartX", with the directory relationship.

Founding year

A sourced year when known. null means unknown, not zero.

Evidence

A source listing, check timestamp, and verified_email_domain match method.

View the response shape

Illustrative values below, not a real company record. Userinfo wraps the identity in data; the OAuth token exchange includes profile metadata under trustedrouter.

Example response JSON

{
  "data": {
    "sub": "usr_example",
    "email": "person@example.com",
    "email_verified": true,
    "company_affiliations": [
      {
        "company_name": "Example Company",
        "funding_organization": "StartX",
        "relationship": "accelerator",
        "domain": "example.com",
        "founding_year": null,
        "source_url": "https://web.startx.com/community",
        "checked_at": "2026-09-12T00:00:00+00:00",
        "match_method": "verified_email_domain"
      }
    ]
  }
}