Magic AuthThe platform
Identity is the starting point.
Connect the actions around it: verification, approval, access and secure storage.
Verify
Establish who is there.
A verification session brings evidence, a decision and its signed receipt together. The workflow includes human review. Public identity enrolment remains closed while the identity checks and duplicate-profile controls complete validation.
- Short-lived session tokens
- A server-formed decision
- Signed provenance receipts
Verification decision
Identity assurance target: IAL2. Certification has not been awarded.
Read the API documentationSign
Record an explicit approval.
Bind a signing request to a document hash and the subject approving it. Device signatures and timestamp evidence form part of the validation bundle. A complete production journey also needs device enrolment and document presentation.
- Document hash binding
- Device-bound signatures
- Receipt and timestamp evidence
Signing validation bundle
Production enablement depends on the complete device and timestamp trust path.
Read the API documentationAuthenticate
Give access an identity context.
Use the OIDC authorisation-code flow for integrations, and passkeys for supported account journeys. Keep identity assurance distinct from possession of an authenticator.
- PKCE S256
- Exact redirect matching
- TOTP account support
An authenticated session
Client registration and end-to-end native enrolment are required before rollout.
Read the API documentationVault
Keep secrets with their owner.
The API stores opaque ciphertext. Client encryption and key management determine whether a complete user journey meets the zero-knowledge design. Each client must pass that validation before use with real secrets.
- Client-controlled encryption
- Ciphertext synchronisation
- Per-user ownership checks
Encrypted item synchronisation
The zero-knowledge design must be verified across every shipping client.
Read the API documentationChoose a workflow first.
Compare allowances and plan an integration.