Product

Identity management

Accounts, credentials, sessions and the authority decisions that govern what each principal may do.

What is live

Accounts, sessions, credentials, and the authority decision behind every request.

POST /auth/register creates an account; the address is verified by a single-use code.
POST /auth/login opens a session; failures lock the credential, never the account.
POST /auth/passkeys registers or asserts a passkey; a key revoked mid-ceremony cannot complete.
GET /account/sessions lists the caller's own live sessions.

Each decision is written to the audit chain before the effect it authorises.