Hanzo IAM

The sign-in behind every Hanzo service. It speaks OpenID Connect and OAuth 2.0, so your application reads a standard discovery document, receives a signed token and never handles a password.

• Authorization code with PKCE, always S256.
• The passwords that do exist are argon2id digests, and a scheme IAM does not recognize fails closed.
• Refresh tokens are single-use and kept only as a hash. Presenting a spent one revokes the whole family, so a stolen token cannot outlive its session.
• A second factor is an authenticator app, a code by SMS or email, or a passkey. Adding or dropping one signs the account out of every other browser.
• Sign-in arrives from Google, from GitHub or from any OIDC issuer you name, and SCIM 2.0 keeps a directory in step.
• Tokens are signed RS256, with ML-DSA-65 available per certificate and published in the same JWKS.
• Every organization is a tenancy boundary, and membership travels in the token.
• What you may reach once signed in is Authz’s to decide, reading the same token.