Authorization security
Authorization Code, exact redirect matching, PKCE, state, nonce, short-lived codes, and replay protection.
Security
Security is a shared implementation contract.
UnifyID protects the identity boundary. Your application must preserve that boundary from authorization through storage, use, and deletion.
Read the security guideIdentity boundaries
Pairwise subject identifiers, explicit scopes, document constraints, minimal UserInfo, and consent records.
Credential security
Environment separation, one-time secret display, rotation, revocation, expiry, last-used context, and audit history.
Webhook integrity
HMAC signatures, timestamps, delivery identifiers, replay controls, retry history, and secret rotation.
Platform protection
Encryption, least privilege, MFA, rate limiting, monitoring, backups, incident response, and provider isolation.
Developer responsibility
Protect backend secrets, validate tokens and signatures, minimize retention, honour revocation, and monitor failures.
Vulnerability disclosure
Report security issues responsibly.
Do not access other people’s data, disrupt the platform, expose live credentials, or publicly disclose an unresolved issue.