Security

Protocol

OpenID Connect Authorization Code with PKCE (S256) only, following the OAuth 2.0 Security BCP (RFC 9700): exact redirect URI matching, single-use short-lived codes, rotating refresh tokens with family revocation on reuse, and token revocation.

Authentication and approval

Browser sign-in requires a registered device credential and a verified signature. Palm sign-in uses a scanner linked to the same account. Application approvals bind the application, intended user, exact action and expiry. A request cancelled during verification cannot later be approved.

Keys and delivery

Applications validate signed tokens with our published verification keys. Client secrets stay on application servers. Security state and acknowledgement records survive service restarts in encrypted transactional storage. Repeated delivery can be reconciled; the application must deduplicate its own business operation.

Service scope

Palm verification requires an active account, a linked scanner and a verified enrollment. Application access controls and account restrictions remain effective. The capture app is part of the trusted system. Certification, hardware assurance, organization isolation and availability commitments must be assessed for the selected deployment.

Reporting

Report a security issue to info@veyns.io.