Protect the authorization flow
Use registered redirect addresses, PKCE S256, state, and nonce as described in the integration guide.
Security
Build a secure integration from sign-in to session.
UnifyID handles its hosted identity and authorization flow. Your application validates the response and controls access to its own services.
Layered controls
Protect the flow and the information you receive.
Validate before creating a session
Validate token signatures, issuer, audience, expiry, and the relevant transaction checks before establishing your application session.
Handle information carefully
Request appropriate scopes and protect the information your application receives.
Manage credentials and events
Follow the documented guidance for client secrets, webhook verification, and permission lifecycle events.
Shared responsibility
A valid signature is not the final policy decision.
UnifyIDHandles the hosted identity and authorization flow
Your backendValidates every artifact and enforces the concrete operation before business logic
Your teamOwns purpose, access, deployments, data handling, monitoring, response, and compliance
The personReviews requests, approves or declines, and manages connected application permissions
Responsible disclosure
Report security concerns privately.
Do not access other people's data, disrupt service, expose live credentials, or publish an unresolved issue. Include the affected surface, impact, safe reproduction detail, and a secure way to follow up.
Build with UnifyID
Qualify the whole system before production.
Test rejection, replay, expiry, rotation, withdrawal, revocation, outage, and recovery—not only the successful path.