VAuth — Complete Authentication Platform Functionality List

Your current VAuth MVP already provides a solid foundation: reusable client applications, app-scoped memberships, database-backed RBAC, email/password authentication, Google OAuth, short-lived access tokens, rotating refresh tokens, reuse detection, session revocation, security audit logging, and a typed authentication client.

The README correctly identifies the major missing areas: OIDC provider mode, SAML, MFA, passkeys, email verification, password reset, hosted authentication pages, distributed throttling, and production-scale deployment.

A complete authentication platform should cover the following functionality domains.

1. User Registration and Account Creation

Essential

Email and password registration
Email normalization and case-insensitive uniqueness
Password confirmation
Terms of service and privacy-policy acceptance
Email verification before account activation
Resend verification email
Verification-link expiration
Single-use verification tokens
Verification attempt throttling
Duplicate account detection
Existing-account suggestion when social email matches
Default client-app membership creation
Default role assignment
Registration audit event
Registration notification email
Registration source tracking:
- Web
- Mobile
- Admin invitation
- Social login
- Enterprise SSO
- API-created account

Additional

Username-based registration
Phone-number registration
Invite-only registration
Organization invitation acceptance
Progressive profile completion
Minimum-age confirmation
Country or region restrictions
Registration waitlist
CAPTCHA or bot challenge for suspicious registrations
Disposable-email detection
Admin-created users
Bulk user import

2. Email and Contact Verification

Email verification
Email verification status
Resend-verification flow
Verification-email throttling
Verification token expiration
Verification token hashing
Change-email verification
Verification of both old and new email when changing email
Primary email selection
Multiple verified email addresses
Phone-number verification
Phone OTP delivery
OTP expiration and attempt limits
Recovery email
Notification when email or phone changes
Administrative verification override with audit logging

3. Password Authentication

Password login

Email and password sign-in
Username and password sign-in
Client-app validation
Membership-status validation
Account-status validation
Constant-time credential checks
Generic errors that do not reveal whether an account exists
Failed-attempt tracking
Progressive delay after repeated failures
Distributed rate limiting
Password-spray detection
Credential-stuffing protection
Login audit events

Password security

Argon2id password hashing
Configurable hashing parameters
Automatic password rehash when parameters change
Password strength validation
Compromised-password blocklist
Common-password rejection
User-information similarity checks
Maximum password length protection
Unicode password support
Secure paste support
Show/hide password control
Password-manager compatibility
Password history only where policy requires it
No mandatory periodic password rotation without a security reason
No security questions

4. Forgot Password and Password Recovery

“Forgot password” request
Account-enumeration-safe response
Password reset email
Hashed reset token
Single-use reset token
Short token expiration
Reset-request throttling
Reset-attempt throttling
Invalidate previous reset requests
Validate account status before reset
Set new password
Password strength and breached-password checks
Password-changed timestamp
Revoke all existing sessions after reset
Revoke refresh-token families
Revoke remembered devices when appropriate
Notify user after password reset
Security alert when reset was not initiated by the user
Administrative password reset
Temporary password with forced change
Recovery through verified MFA factor
Account-recovery review for users who lose every factor
Recovery cooling-off period for high-risk accounts

5. Password and Credential Management

Change password while signed in
Require current password before changing it
Step-up authentication before credential changes
Set a password for social-login-only accounts
Remove password only when another secure sign-in method exists
Password last-changed date
Credential versioning
Revoke sessions after password change
Notify user about password change
View registered authentication methods
Add or remove authentication methods
Select preferred sign-in method
Require at least one recovery-capable method

6. Social and External Authentication Providers

VAuth should implement providers through a common adapter interface rather than writing unrelated logic for every provider.

Recommended providers

Google
Sign in with Apple
Microsoft / Entra ID
GitHub
Facebook
LinkedIn
Discord
Slack
Amazon
X
Generic OAuth 2.0 provider
Generic OpenID Connect provider

Provider functionality

Provider authorization redirect
Signed and encrypted state
PKCE where supported
Nonce validation for OIDC
Exact redirect URI validation
Authorization callback
Server-side code exchange
ID-token validation
Issuer validation
Audience validation
Signature validation
Token-expiration validation
Provider key caching and rotation
Profile and claim mapping
Provider-email verification handling
New account creation
Existing account linking
Explicit account-link confirmation
Unlink provider
Prevent unlinking the final usable sign-in method
Provider access-token storage only when required
Provider refresh-token encryption
Provider consent revocation
Provider disconnection webhooks
Login and linking audit events

Sign in with Apple-specific requirements

Services ID configuration for web clients
Apple private-key configuration
Apple client-secret JWT generation
Apple identity-token verification
Apple public-key rotation handling
Apple private relay email support
Store the name returned during the first authorization
Handle users hiding their actual email address
Account linking through Apple’s stable subject identifier
Apple account-change notifications
Provider credential rotation
Native Apple Authentication Services support
Web and Android support through Apple’s REST/JS flow

Apple’s server integration requires generating and validating identity tokens and configuring a Services ID and private key for web-service authentication. (Apple Developer)

7. Account Linking and Identity Resolution

A user may authenticate through password, Google, Apple, Microsoft, or enterprise SSO while still representing one VAuth user.

Required functionality:

One user with multiple external identities
Link social account while authenticated
Link password credentials to a social account
Link providers only after reauthentication
Resolve verified-email matches safely
Never auto-link solely using an unverified email
Detect provider-subject conflicts
Prevent one external identity linking to multiple users
Unlink provider
Account merge workflow
Duplicate-account review
Preserve memberships during merging
Preserve audit history
Revoke sessions after sensitive identity changes
Notify user when identity is linked or removed
Administrator-assisted merge with full audit logging

8. Multi-Factor Authentication

A real MFA implementation must use two distinct authentication factors. Two passwords or a password plus PIN are not MFA because both are knowledge factors. NIST’s current guidance defines AAL2 as requiring two distinct factors and requires offering a phishing-resistant option. (NIST Pages)

Supported MFA factors

TOTP authenticator applications

Google Authenticator
Microsoft Authenticator
Authy-compatible TOTP
1Password
Bitwarden
Other RFC-compatible authenticator apps

Functionality:

Generate TOTP secret
QR-code enrollment
Manual secret entry
Confirm code before activation
Encrypted secret storage
Clock-skew tolerance
Replay prevention
Factor naming
Factor removal
Multiple TOTP factors
Regenerate factor

Passkeys and security keys

WebAuthn registration
WebAuthn authentication
Platform passkeys
Synced passkeys
Hardware security keys
Discoverable credentials
Non-discoverable credentials
Passwordless login
Passkey as a second factor
User-verification requirements
Credential naming
Multiple passkeys per account
Credential last-used information
Credential deletion
Counter and clone-risk handling
Resident-key support
Cross-device authentication
Conditional UI/autofill support
Attestation-policy configuration

WebAuthn uses scoped public-key credentials and provides stronger phishing resistance than manually entered OTP methods. The current WebAuthn Level 3 specification reached an updated Candidate Recommendation Snapshot on May 26, 2026. (W3C)

Additional factors

Email OTP
SMS OTP
Voice-call OTP
Push authentication
Mobile-app approval
Hardware OTP
Recovery codes

Email, SMS, and manually entered TOTP codes can provide additional factors, but they are not phishing-resistant. Passkeys or hardware security keys should be the preferred high-security option. (NIST Pages)

MFA management

MFA enrollment
MFA challenge
MFA enrollment policy
MFA required by client application
MFA required by organization
MFA required by role
MFA required for administrators
Factor-selection screen
Preferred factor
Alternative-factor selection
Multiple registered factors
Recovery codes
Hash recovery codes
Display recovery codes only once
Regenerate recovery codes
Factor reset
Administrator-assisted MFA reset
MFA-reset delay
Notification after factor enrollment or removal
Audit all factor changes

Step-up authentication

Require fresh or stronger authentication before:

Changing password
Changing email
Changing phone number
Removing MFA
Viewing recovery codes
Creating an API key
Rotating client secrets
Changing permissions
Adding administrators
Initiating payments
Exporting sensitive data
Deleting the account
Performing high-risk administrative actions

9. Adaptive and Risk-Based Authentication

Risk signals

New device
Unknown browser
New IP address
IP reputation
TOR or proxy usage
Datacenter IP
Unusual country
Impossible travel
Unusual login time
Rapid failed attempts
Password spraying
Credential stuffing
Known breached credentials
Multiple-account activity from one device
Session-cookie anomalies
Refresh-token reuse
Unusual privilege escalation
High-risk API access

Risk responses

Allow authentication
Require CAPTCHA
Require email verification
Require MFA
Require passkey or security key
Require recent authentication
Block authentication
Temporarily lock account
Revoke suspicious session
Revoke all sessions
Send security alert
Request administrative review

Remembered devices

“Trust this device”
Configurable trust duration
Device-bound trust token
View trusted devices
Revoke trusted device
Automatically expire trust after:
- Password reset
- MFA reset
- Risk event
- Administrator action

10. Passwordless Authentication

Email magic links
Email OTP
Passkey-only sign-in
Phone OTP
Enterprise SSO-only accounts
Social-login-only accounts
Magic-link expiration
Magic-link single use
Bind magic links to the initiating browser when appropriate
Prevent email-link scanners from consuming authentication links
Resend throttling
Attempt limits
Notify users about passwordless sign-ins
Option to convert password accounts to passwordless accounts
Account recovery without weakening passwordless security

11. VAuth as an OpenID Connect Relying Party

This means VAuth accepts authentication from another identity provider.

Required functionality:

Generic OIDC connection configuration
Issuer discovery
Provider metadata retrieval
JWKS retrieval and caching
Authorization endpoint integration
Token endpoint integration
UserInfo endpoint integration
Authorization Code flow
PKCE
State validation
Nonce validation
ID-token validation
Claim mapping
Configurable scopes
Custom claim mapping
Group-to-role mapping
Provider logout
Refresh-token support
Provider-key rotation
Multiple OIDC connections
Per-organization OIDC connections
Home-realm discovery
Just-in-time user provisioning

12. VAuth as an OAuth 2.0 Authorization Server

This is different from merely accepting Google or Apple login. In this mode, VAuth becomes the system through which external applications authenticate users and receive standards-compliant tokens.

Authorization grants

Required

Authorization Code Grant
Authorization Code with PKCE
Refresh Token Grant
Client Credentials Grant

Optional

Device Authorization Grant
Token Exchange
JWT Bearer Grant
SAML Bearer Grant

Do not implement:

Implicit Grant
Resource Owner Password Credentials Grant

Current OAuth security guidance recommends Authorization Code with PKCE, exact redirect URI matching, secure refresh-token handling, and authorization-server metadata. (RFC Editor)

OAuth endpoints

GET /oauth/authorize
POST /oauth/token
POST /oauth/revoke
POST /oauth/introspect
POST /oauth/device-authorization
POST /oauth/par for pushed authorization requests
GET /oauth/userinfo when used with OIDC

Authorization request handling

Validate client ID
Validate client status
Exact redirect URI matching
Validate response type
Validate requested scopes
PKCE S256 support
State preservation
OIDC nonce support
Login-required handling
Consent-required handling
prompt support
max_age support
login_hint
ui_locales
Authentication context request
Authorization request expiration
One-time authorization codes
Very short authorization-code lifetime
Code-to-client binding
Code-to-redirect-URI binding
Code-to-PKCE-verifier binding
Code replay detection

Client authentication

Public clients
Confidential clients
client_secret_basic
client_secret_post
private_key_jwt
Mutual TLS for high-security clients
Client-secret expiration
Client-secret rotation
Multiple active secrets during rotation
Client assertion replay prevention

Token security

Audience-restricted access tokens
Scope-restricted access tokens
App-scoped tokens
JWT access tokens
Opaque access tokens where required
Token introspection
Token revocation
Refresh-token rotation
Refresh-token family tracking
Reuse detection
Sender-constrained tokens using DPoP or mutual TLS for advanced deployments
Signing-key rotation
Encryption-key rotation
Per-client token lifetime
Per-scope token lifetime
Token revocation after permission changes
Unique token identifiers
Issued-at and expiration claims
Clock-skew handling

13. VAuth as an OpenID Connect Provider

OpenID Connect adds identity authentication on top of OAuth.

Required endpoints

/.well-known/openid-configuration
/.well-known/oauth-authorization-server
/oauth/authorize
/oauth/token
/oauth/userinfo
/.well-known/jwks.json
/oauth/revoke
/oauth/introspect
/oauth/logout

ID token functionality

Signed ID tokens
Configurable signing algorithms
iss
sub
aud
exp
iat
auth_time
nonce
azp
sid
acr
amr
at_hash
c_hash where applicable
Pairwise subject identifiers
Public subject identifiers
Per-client claims
Custom claims
Group claims
Role claims
Permission claims with size controls

Standard scopes

openid
profile
email
phone
address
offline_access

Consent management

Consent screen
Application name and logo
Requested-scope explanation
First-party application policy
Remember consent
Revoke consent
View authorized applications
Scope-specific consent
Administrative consent
Organization-wide consent
Incremental authorization

Discovery and key distribution

OIDC discovery metadata
OAuth authorization-server metadata
Public JWKS
Multiple active signing keys
Key ID support
Safe key rollover
Old-key overlap during rotation
Algorithm allowlist
Metadata caching headers
Issuer consistency validation

OpenID Connect Core, Discovery, Dynamic Client Registration, and Back-Channel Logout have approved errata specifications. (OpenID Foundation)

14. Single Sign-Out and Session Federation

Application-initiated logout
Identity-provider logout
Current-session logout
All-session logout
Per-client logout
Per-organization logout
RP-Initiated Logout
Front-Channel Logout
Back-Channel Logout
Session Management
Post-logout redirect URI validation
ID-token logout hint
Session ID claim
Logout-token signing
Logout-token replay protection
Downstream session revocation
Logout failure retry
Logout webhook
Audit logout propagation

OIDC defines RP-initiated, front-channel, back-channel, and session-management logout specifications. (OpenID Foundation)

15. Client Application Management

Each consuming application should have its own security configuration.

Client registration

Client name
Public client ID
Client type:
- Server-rendered web application
- SPA
- Native mobile application
- CLI
- Machine-to-machine service
- Smart device
Application owner
Application logo
Homepage
Privacy-policy link
Terms link
Allowed origins
Exact redirect URIs
Post-logout redirect URIs
Allowed grant types
Allowed response types
Allowed scopes
Token endpoint authentication method
Client status
Development, staging, and production environments

Client credentials

Generate client secret
Hash client secret
Show secret once
Secret expiration
Multiple secrets
Secret rotation
Secret revocation
Public-key registration
JWKS URI
private_key_jwt
Mutual-TLS certificate registration
Credential usage audit events

Client policies

Access-token lifetime
Refresh-token lifetime
Session lifetime
MFA requirement
Allowed authentication methods
Allowed social providers
Required assurance level
First-party or third-party classification
Consent requirements
IP restrictions
Organization restrictions
Custom claims
Branding configuration
Webhook configuration
Rate limits

Dynamic registration

Dynamic Client Registration
Initial access tokens
Registration access tokens
Software statements
Administrative approval
Client registration policy
Registration update
Registration deletion

16. Device Authorization

Useful for smart TVs, command-line tools, game consoles, printers, and devices without a convenient browser.

Device authorization endpoint
Device code
Human-readable user code
Verification URL
QR code
Polling interval
Slow-down response
Device-code expiration
User approval screen
User denial
Scope display
Device information display
Token issuance after approval
Brute-force protection
Audit trail

The OAuth Device Authorization Grant is specifically designed for connected devices with limited browser or input capabilities. (RFC Editor)

17. Session Management

Your current token rotation and current/all-session sign-out are a good base.

Add:

Session creation
Server-side session record
Session ID
User-agent information
Device information
IP address
Approximate location
Client application
Authentication methods used
MFA status
Authentication assurance level
Session created time
Last activity time
Absolute expiration
Idle expiration
“Remember me”
Concurrent-session limits
View active sessions
Revoke one session
Revoke all other sessions
Revoke all application sessions
Session extension
Forced reauthentication
Step-up authentication state
Sensitive-action freshness window
Session fixation prevention
Cookie rotation
Secure, HTTP-only, SameSite cookies
CSRF protection
Session activity audit
New-device alerts
Suspicious-session termination

18. Token Management

Access tokens
Refresh tokens
ID tokens
Authorization codes
Device codes
One-time exchange codes
Password-reset tokens
Email-verification tokens
Magic-link tokens
API keys
Service-account credentials

For each token type:

Cryptographically random generation
Purpose binding
Client binding
User binding
Audience binding
Scope binding
Issued-at timestamp
Expiration
One-time-use enforcement where required
Hashed storage for bearer secrets
Revocation
Token-family relationships
Replay detection
Rotation
Audit events
Secure cleanup
Key-version tracking

19. Authorization and Access Control

Existing RBAC improvements

App-specific roles
App-specific permissions
Multiple roles per membership
Default roles
System roles
Custom roles
Role cloning
Role hierarchy
Permission groups
Role-permission assignment
Membership-role assignment
Permission-change audit
Prevent deletion of protected roles
Prevent removal of the final owner
Permission cache invalidation
Token invalidation after critical role changes

Additional authorization models

OAuth scopes
Resource-level permissions
Ownership checks
Organization-level roles
Team-level roles
Attribute-Based Access Control
Relationship-Based Access Control
Policy-based authorization
Conditional access policies
Time-based access
IP-based access
Device-trust requirements
Authentication-strength requirements
Delegated administration
Temporary role assignment
Role-assignment expiration
Approval workflows
Separation of duties
Authorization-decision API
Policy simulation and testing

20. Organizations, Teams and Multi-Tenancy

Organizations
Organization memberships
Teams
Team memberships
Organization roles
Team roles
Organization invitations
Invitation expiration
Invitation resend
Invitation cancellation
Domain verification
Auto-join by verified domain
Organization discovery
Organization switching
Multiple memberships
Organization-specific identity policies
Organization-specific MFA policy
Organization-specific session policy
Organization-specific social providers
Organization-specific SSO
Organization-specific branding
Organization audit logs
Organization administrators
Billing-owner role
Transfer ownership
Suspend organization
Delete organization
Data isolation between tenants
Tenant-aware tokens
Tenant-aware rate limits

21. Enterprise SSO

SAML 2.0

SAML service-provider mode
Metadata import
Metadata export
Single Sign-On URL
Entity ID
Assertion Consumer Service endpoint
X.509 certificate management
Certificate rotation
Signed assertions
Encrypted assertions
Audience restriction
Recipient validation
InResponseTo validation
Clock-skew handling
NameID mapping
Attribute mapping
Group mapping
IdP-initiated login
SP-initiated login
Single Logout
Multiple enterprise connections
Per-organization SAML configuration

Enterprise OIDC

Issuer discovery
Client credentials
Scope configuration
Claims mapping
Group mapping
Provider logout
Multiple enterprise OIDC connections
Per-organization routing

SSO policies

Mandatory SSO
Disable password login for managed domains
Break-glass administrator accounts
Home-realm discovery
Email-domain routing
Just-in-time provisioning
Automatic role assignment
Default organization assignment
SSO connection test
SSO health monitoring

22. SCIM User and Group Provisioning

SCIM 2.0 server
SCIM bearer tokens
Token rotation
/Users
/Groups
/Schemas
/ResourceTypes
/ServiceProviderConfig
Create users
Update users
Deactivate users
Reactivate users
Delete users where policy allows
Create groups
Update groups
Group membership synchronization
Filtering
Sorting
Pagination
Bulk operations
External ID mapping
Idempotent provisioning
Group-to-role mapping
Provisioning audit logs
Webhook or event publication
SCIM integration testing

SCIM standardizes HTTP-based identity provisioning and management for users and groups across enterprise and cloud systems. (RFC Editor)

23. Service Accounts and Machine Authentication

Service accounts
Machine-to-machine clients
Client Credentials Grant
Service-account roles
Service-account permissions
Client secrets
Asymmetric credentials
private_key_jwt
Mutual TLS
API keys
API-key scopes
API-key expiration
API-key rotation
API-key revocation
IP allowlists
Workload identity federation
Service-account impersonation
Short-lived machine tokens
Audit machine access separately from human access
Prevent interactive sign-in for service accounts

24. User Profile and Account Lifecycle

View profile
Update name
Update avatar
Update locale
Update timezone
Update email
Update phone
Manage linked identities
Manage MFA factors
Manage passkeys
Manage sessions
Manage authorized applications
Manage organization memberships
Download personal data
Request account deletion
Cancel deletion during grace period
Account deactivation
Account suspension
Account lock
Account closure
Reactivation
Anonymization
Retention-policy execution
Account-status history
Account-deletion audit
Notify connected applications of account changes

Account states

Pending verification
Active
Locked
Suspended
Disabled
Recovery pending
Deletion pending
Deleted
Anonymized

25. Security Notifications

Notify users when:

Account is created
Email is verified
New sign-in occurs
Sign-in occurs from a new device
Suspicious sign-in occurs
Password is changed
Password is reset
Email is changed
Phone number is changed
MFA is enabled
MFA is disabled
MFA factor is added
MFA factor is removed
Recovery codes are regenerated
Passkey is added or removed
Social identity is linked or unlinked
Session is revoked
Account is locked
Account is suspended
Account recovery is initiated
Account deletion is requested
Administrator changes the account
Client secret or API key is created or rotated

Notification functionality:

Email templates
SMS templates
Push templates
Localization
Template versioning
Per-client branding
Delivery tracking
Bounce and complaint handling
Retry policy
Resend throttling
User notification preferences
Mandatory security notifications that cannot be disabled

26. Administrative Console

User administration

Search users
View user
View memberships
View linked identities
View authentication methods
View sessions
View login history
View risk events
Verify email
Suspend user
Reactivate user
Lock or unlock user
Force password reset
Reset MFA
Revoke sessions
Revoke tokens
Remove provider connection
Delete or anonymize user
Export user data
Add internal notes
Impersonate user with strict safeguards

Client administration

Register client
Update client
Disable client
Delete client
Rotate secrets
Configure redirect URIs
Configure scopes
Configure token policy
Configure providers
Configure branding
Configure webhooks
View client activity

Security administration

View failed logins
View suspicious events
View locked accounts
View token-reuse incidents
View provider failures
View audit logs
Search by IP, user, client, event, or session
Configure rate limits
Configure risk policies
Configure MFA policy
Configure password policy
Configure session policy
Manage signing keys
Review administrative actions

27. Audit Logging and Security Events

Capture:

Registration
Verification
Sign-in success
Sign-in failure
MFA challenge success or failure
Password reset
Credential change
Provider linking
Provider unlinking
Session creation
Session revocation
Refresh-token rotation
Refresh-token reuse
Role change
Permission change
Client creation
Secret rotation
Administrative action
SSO configuration change
SCIM provisioning
Data export
Account deletion
Risk-policy decision

Each event should contain:

Event ID
Timestamp
Actor
Subject
Client application
Organization
Session ID
Request ID
IP address
User agent
Device information
Action
Result
Failure reason
Risk score
Authentication methods
Before/after changes
Structured metadata

Additional functionality:

Immutable audit retention
Tamper-evident logging
Search and filtering
Export
SIEM integration
Security-event webhooks
Retention policies
Sensitive-field redaction
Administrative access audit

28. Abuse and Attack Protection

Distributed rate limiting
Per-IP limits
Per-account limits
Per-client limits
Per-endpoint limits
Per-device limits
Progressive backoff
Credential-stuffing detection
Password-spray detection
Brute-force protection
Registration-bot detection
Verification-email bombing protection
Password-reset bombing protection
OTP-guessing protection
CAPTCHA escalation
IP reputation
Device fingerprint signals
Suspicious proxy detection
Replay detection
CSRF protection
Open-redirect prevention
SSRF protection for OIDC discovery
Redirect URI exact matching
OAuth mix-up attack protection
Authorization-code injection protection
JWT algorithm confusion protection
Key-ID injection protection
Token audience validation
Token issuer validation
Refresh-token reuse detection
Signed webhook verification
Request-body size limits
Security-header enforcement

29. Hosted Authentication UI

Your current frontend is a reference client. A reusable platform should also provide hosted authentication pages that arbitrary clients can use.

Required pages:

Sign up
Sign in
Verify email
Forgot password
Reset password
MFA enrollment
MFA challenge
Passkey enrollment
Passkey authentication
Consent
Device authorization
Organization selection
Enterprise SSO discovery
Account linking
Account recovery
Error page
Logout confirmation
Authorized applications
Session management
Profile and security settings

Customization:

Logo
Brand name
Colours
Fonts
Favicon
Custom domain
Email templates
Per-client branding
Per-organization branding
Localization
Right-to-left language support
WCAG accessibility
Mobile responsiveness
Dark mode
Content Security Policy
Anti-clickjacking protections

30. Developer Experience

Typed TypeScript SDK
Next.js server SDK
Next.js middleware
NestJS guards
React components
React hooks
Node.js SDK
Mobile SDKs
CLI SDK
Machine-to-machine SDK
OpenAPI specification
Generated clients
Hosted-login integration
Headless API integration
Webhook SDK and signature verifier
Session helper
Token verifier
JWKS client
Permission guard
Organization middleware
MFA challenge helper
Example applications
Local development mode
Test users
Sandbox environment
Test OAuth clients
Mock email delivery
Migration tools
User import/export
Documentation portal
Integration diagnostics
Provider-configuration validation

31. Webhooks and Event Integration

Events for:

User created
User updated
User verified
User suspended
User deleted
Login succeeded
Login failed
MFA enabled
MFA disabled
Password changed
Password reset
Session created
Session revoked
Token reuse detected
Membership created
Role changed
Permission changed
Organization created
SSO connection changed
SCIM user provisioned

Webhook functionality:

Signed webhook payloads
Timestamped signatures
Replay protection
Delivery attempts
Retry with backoff
Dead-letter handling
Manual replay
Endpoint secret rotation
Per-client subscriptions
Event filtering
Delivery logs
Disable failing endpoints
Idempotency keys

32. Privacy and Compliance

Data minimization
Purpose-specific data collection
Privacy-policy consent
Terms acceptance history
Consent withdrawal
User data export
Account deletion
Data anonymization
Retention policies
Audit retention
Regional data-storage controls
DPDP Act readiness
GDPR readiness
Access logs for personal data
Administrative reason capture
PII encryption
Secret-field encryption
Data-processing records
Breach-response workflow
Legal-hold support
Cookie-consent integration where applicable
Children’s account restrictions where applicable
Configurable privacy notices

33. Reliability and Production Operations

Shared Redis-backed rate limiting
Distributed session and risk state
Queue-backed email and SMS
Retry and dead-letter queues
Database connection pooling
Readiness and liveness endpoints
Structured logging
Metrics
Distributed tracing
Authentication latency metrics
Login success-rate metrics
MFA completion metrics
Provider-error metrics
Token-reuse alerts
Email delivery metrics
SSO health monitoring
Signing-key health monitoring
Key rotation automation
Secret-manager integration
KMS or HSM integration
Database backups
Point-in-time recovery
Disaster recovery testing
Multi-instance deployment
Zero-downtime migrations
Incident response procedures
Security runbooks
Service-level objectives
Capacity and load testing
Multi-region deployment as a later capability

Recommended Implementation Order

Phase 1 — Complete the Existing Authentication Core

Build these first:

Email verification
Forgot and reset password
Change password
Change email with verification
Account status management
Session and device management UI
Security notifications
Distributed Redis throttling
Login-attempt and credential-stuffing protection
Hosted sign-in, sign-up and recovery pages

This closes the most important gaps in normal account lifecycle management.

Phase 2 — MFA and Passwordless Security

TOTP MFA
Recovery codes
MFA policies
Step-up authentication
Passkeys/WebAuthn
Security-key support
Trusted devices
MFA recovery
Authentication assurance claims
Risk-based MFA

Passkeys should be treated as a primary capability, not merely a distant optional feature, because phishing-resistant authentication is increasingly central to modern MFA guidance. (NIST Pages)

Phase 3 — Authentication Provider Expansion

Sign in with Apple
Microsoft
GitHub
Generic OIDC provider
Common provider adapter architecture
Identity linking
Duplicate-account resolution
Provider token and key rotation
Provider disconnection handling

Phase 4 — Standards-Compliant OIDC Provider

Authorization endpoint
Token endpoint
Authorization Code with PKCE
ID tokens
UserInfo
OIDC discovery
OAuth metadata
JWKS
Consent
Scopes and claims
Revocation and introspection
Signing-key rotation
RP-Initiated Logout
Front-Channel and Back-Channel Logout
OIDC conformance testing

This transforms VAuth from a reusable custom auth service into a standards-compatible identity provider.

Phase 5 — Organizations and Enterprise Identity

Organizations and teams
Organization policies
Domain verification
Enterprise OIDC
SAML 2.0
Just-in-time provisioning
Group-to-role mapping
SCIM users and groups
Mandatory SSO
Delegated organization administration

Phase 6 — Advanced Security and Platform Features

Adaptive authentication
Risk engine
Device Authorization Grant
Client Credentials Grant
Service accounts
DPoP
Mutual TLS
Private-key JWT client authentication
Policy-based authorization
SIEM and security-event integration
Multi-region deployment
Advanced compliance controls

Recommended Final Product Scope

For VAuth, I would define the complete product as six connected systems:

Identity Directory — users, profiles, identities, organizations and memberships.
Authentication Engine — passwords, social login, Apple, MFA, passkeys and recovery.
Authorization Engine — roles, permissions, scopes, policies and app isolation.
OAuth/OIDC Server — authorization, tokens, discovery, JWKS, consent and logout.
Enterprise Identity Layer — SAML, enterprise OIDC, SCIM and domain-based SSO.
Security Operations Layer — sessions, risk detection, audit events, notifications, administration and monitoring.

The next practical milestone should be VAuth Phase 1: Complete Account Lifecycle, covering email verification, password recovery, account security settings, device/session management, and production-grade distributed abuse protection.

FilesExpand file tree

futureWork.md

Latest commit

History