Authentication methods and availability
Provider-owned authentication
Section titled “Provider-owned authentication”The implementation covers password verification, passkeys/WebAuthn, TOTP, email OTP/magic links, recovery and upstream OIDC. This list does not promise every mechanism is enabled for every external app.
- The identity provider handles the global account password; an external application should not collect it in its own login form.
- Passkeys require challenge/RP ID/origin/user-verification checks and a trusted secure browser context.
- TOTP/recovery need replay protection and one-time recovery proof consumption. Recovery is a separate flow, not bypassing a rejected factor.
- Email OTP/magic links depend on a configured delivery service; endpoint presence does not prove delivery.
- Upstream OIDC connections belong to the directory and require issuer/audience/nonce validation. Matching email alone does not link an account.
MFA/assurance and the application trust tier are different. A passkey login does not grant a service broader API rights. Certified AAL3 is not claimed.
Features not offered as completed integrations
Section titled “Features not offered as completed integrations”SAML, LDAP bridge, SCIM and phone OTP were plans in the older portal. No completed public contract is promised here. Device Authorization is limited by client type/policy despite discovery advertising an endpoint.
Host-only HttpOnly sessions, native CSRF and first-party Account/Console SSO are internal product mechanisms. External applications integrate through Provider OAuth/OIDC; a product cookie session is not a general API credential.