Our Own Identity Layer: Single Sign-On Across Applications

Чоо-жайы

When one organisation runs several applications, giving every product its own sign-in screen and its own password table tires users out and multiplies the surface that has to be protected.

With our own identity layer, a user signs in to the connected applications with a single account. They enter their email address, type the six-digit one-time code sent to it, valid for five minutes, then complete verification with a security code of 8 to 16 characters they chose themselves. There is no classic password form, and the security code is stored only as an Argon2id hash. Trusted devices are remembered for 90 days. Phone sign-in is built but stays switched off until an SMS provider is connected.

The system returns identity only: user id, name, email and phone. Role and permission data is never passed to applications. Each application resolves authorization in its own database, keyed by the stable user id the provider hands back. That way, when one application changes its permission model, the identity layer is untouched.

Identity data reaches an application only with the consent the user gave for that application, and the user can revoke that consent from their profile. Sessions live on real activity; a background status check does not extend a session on its own. When an account is suspended or consent is revoked, the connected application learns about it on its next session check.

Sign-in attempts are logged with their IP address, and users can see their own sign-in history in their profile. Someone receiving code emails they did not ask for can stop delivery to that address through the link in the email. Authorization codes are single-use and valid for thirty seconds, and exchanging a code for an identity requires the application's own secret. The infrastructure is further protected by TLS 1.3, encrypted storage of email addresses, Cloudflare Turnstile and four-layer rate limiting.