Handle and Brand Policy

Each person may claim one handle. A handle is unique across all of Authfu, not just within one application. When you sign in to an application, Authfu sends your handle in the OpenID Connect preferred_username claim.

We chose a global namespace deliberately. You claim a name once and keep it instead of choosing a new username in every application.

A global handle follows you. Every application you sign in to receives it, so choose a name you are content to be known by across those applications.

A handle must be between 3 and 30 characters long. It may use letters, digits, hyphens, underscores, and periods. It must start with a letter or digit. It cannot end with a hyphen, underscore, or period, and it cannot place two of those separators together.

Handles are case-insensitive. Capitalization does not make a name different, soRiver and river cannot belong to different people.

We compare names in a normalized form that also folds common lookalike characters and sequences. A name that merely looks like an existing handle is treated as the same name and cannot be taken. For example, replacing the letter o with the digit 0 does not create a distinct handle.

On an identity provider, a name that looks like somebody else’s is an impersonation tool. Normalization protects the reader of the name, not just the person who claimed it first.

The global namespace is first come, first served, subject to reserved names and this dispute process. A name will be in one of these states.

We reserve some names before anybody claims them. The categories include:

• well-known company and product names;
• names matching high-traffic domains;
• government and emergency terms; and
• names Authfu uses operationally, such as admin, support, security, billing, help, api, www, and authfu.

We do not publish the reservation list. Publishing it would turn a safety control into a checklist of names to imitate elsewhere.

No list can be complete. Trademarks differ by country and industry, and one word can name a computer company, a record label, and a fruit. Reservation is the first line of defense. The dispute process below handles real conflicts the list misses.

This works because control of the domain is the same proof a brand already relies on for its email and website. Authfu uses the DNS domain check that organizations already complete; it does not create a separate trademark-verification ceremony.

Domain verification releases a matching reserved name. It does not automatically take a handle away from an existing holder. A taken name uses the process below.

A dispute must concern a real conflict. We will consider a registered trademark being used to impersonate its owner, or a name registered in bad faith to sell or to deceive. Wanting a name, having a larger audience, or registering a trademark after somebody adopted the name is not enough by itself.

A trademark does not automatically beat an existing holder. A person whose own name or long-standing username happens to match a brand is not a squatter.

We consider the whole record, including:

• whether the holder has a legitimate connection to the name;
• whether the account is dormant or the handle is unused;
• whether the handle or account is being used to impersonate or mislead;
• whether the handle was registered in order to sell it; and
• whether the complainant has verified the matching domain with Authfu.

No single factor decides every case. In particular, inactivity alone does not turn a legitimate holder into a squatter, and domain verification alone does not erase another person’s legitimate use.

An account actively pretending to be a company or a person is an acceptable-use matter. We handle it immediately under our Acceptable Use Policy, not through the slower process for deciding who should hold a disputed name.

A person may change their handle.

A released handle does not become available for somebody else to take immediately. An application may have recorded the old preferred_username. Immediate reuse could make that application point the old name at a different person, creating confusion or an impersonation risk. Authfu holds released names back while that risk remains.

Applications must key their records on the stable OpenID Connect sub claim, never on a handle or the preferred_username claim. A handle can change; the sub value identifies the account.