01 / 08
PKCE
Authorization code with PKCE, always S256.
02 / 08
Passwords
The passwords that do exist are argon2id digests, and a scheme IAM does not recognize fails closed.
03 / 08
Refresh tokens
04 / 08
A second factor
A second factor is an authenticator app, a code by SMS or email, or a passkey. Adding or dropping one signs the account out of every other browser.
05 / 08
Federation
Sign-in arrives from Google, from GitHub or from any OIDC issuer you name, and SCIM 2.0 keeps a directory in step.
06 / 08
Signing keys
Tokens are signed RS256, with ML-DSA-65 available per certificate and published in the same JWKS.
07 / 08
Organizations
Every organization is a tenancy boundary, and membership travels in the token.
08 / 08
Authorization
What you may reach once signed in is Authz’s to decide, reading the same token.
Refresh tokens are single-use and kept only as a hash. Presenting a spent one revokes the whole family, so a stolen token cannot outlive its session.
Paste and ship
Paste this into any agent. It reads the skill manifest and calls IAM from there.
api/v1/iam
Read https://hanzo.ai/skill.md and use Hanzo IAM in my project. Start with: hanzo iam whoami