Your application integrates once. The person picks the method, and all of them are fail-closed and enumeration-safe: a failure never reveals whether an email, an organization or an account exists.
PasswordEmail, password and organization
NoteHashed with Argon2id; a length-plus-denylist policy aligned with NIST. Optional TOTP.
TOTPPassword, then a six-digit code
NoteOr a one-time recovery code.
Passkeys (WebAuthn)Fingerprint, face or a security key
NotePhishing-resistant and password-free. Also the way to re-prove yourself for a sensitive action.
Social loginContinue with a social provider
NoteEach provider is enabled independently.
Magic linkClick a one-time emailed link
NotePasswordless. Does not count toward step-up.
Enterprise SSOSign in through your own identity provider
NoteOIDC or SAML 2.0. Delegated to the provider; MFA enrolled here still applies.
One person can belong to several organizations. Each organization's policy is evaluated on the way in: one that requires SSO or MFA cannot be entered on the strength of a session another organization accepted.
A standards OpenID Provider, with a deliberately bounded profile.
OAuth 2.1 and OIDC CoreAuthorization code flow, code response type only
DetailPKCE (S256) is mandatory for every client.
ID tokensRS256, verified against published JWKS
DetailUp to three keys published, so tokens verify across a rotation.
- Scopesopenid, profile, email, roles
- Grant typesauthorization_code, refresh_token, client_credentials, device_code
RFC 8252 loopbackRegister a loopback address without a port
DetailAny port is accepted at run time; everything else is compared exactly.
RFC 8628 device grantA code shown on a headless host, approved elsewhere
DetailFor SSH sessions, containers and remote boxes.
RFC 8707 resource indicatorsAudience-bound tokens for your own API
DetailRegister your API as a resource.
Introspection and revocationIs this token live now; end a grant on purpose
DetailIntrospection answers for tokens of your own organization.
Your members sign in through the identity provider you already run, and your directory manages their accounts.
SSO over OIDCAuthorization code with PKCE at your provider; the ID token is validated for signature, issuer, audience, expiry and a one-time nonce.
Authorization code with PKCE at your provider; the ID token is validated for signature, issuer, audience, expiry and a one-time nonce.
NoteOkta, Entra ID, Keycloak, Auth0 and others. Federation never bypasses a second factor.
SSO over SAML 2.0Service-provider metadata to copy or import; your provider's metadata fills the rest.
NotePrefer OIDC when your provider supports both: no certificates to manage.
SCIM 2.0Your directory creates, updates and removes accounts.
NoteDeactivation suspends the membership and ends every active session at once, on every device.
A short-lived access token and a rotating refresh token, for every method above.
DPoP (RFC 9449)Bind tokens to a key the client holds, so a token stolen in transit or from a log is useless without the private key. Opt-in for people; the default posture for AI agents.
Bind tokens to a key the client holds, so a token stolen in transit or from a log is useless without the private key. Opt-in for people; the default posture for AI agents.
- Opaque to clientsA client treats the access token as opaque (RFC 6749). Identity comes from the ID token or UserInfo.
- Offline verificationA resource server verifies the signature against the published keys, with no call per request.
- Sign out everywhereEnds every session for the person across devices.
The platform authenticates the human; your processor moves the money. No card data reaches the platform, which keeps you in PCI DSS SAQ-A.
- Step-upProve it is still you, right now, before a sensitive action.
- SCA with dynamic linkingConfirm this exact payment, and refuse if any detail changed.
- Risk contextWhat the platform knows about this customer before you decide to challenge.