Hanzo IAM

Hanzo IAM is the sign-in behind every Hanzo service. There is one, and this is it. It speaks OpenID Connect and OAuth 2.0 — authorization code with PKCE, always S256 — so your application reads a standard discovery document, receives a signed token, and never handles a password. The passwords that do exist are argon2id digests, and the algorithm is read from the stored row rather than assumed; a scheme IAM does not recognize fails closed rather than passing. Refresh tokens are single-use and kept only as a hash. Each exchange mints a successor, and presenting a spent one revokes the whole family, so a stolen token cannot outlive the session it was taken from. A second factor is an authenticator app, a code by SMS or email, or a passkey, and adding or dropping one signs the account out of every other browser. Sign-in can arrive from Google, from GitHub, or from any OIDC issuer you name, and SCIM 2.0 keeps a directory in step. Tokens are signed RS256, with ML-DSA-65 available per certificate and published in the same JWKS, so a verifier that already knows how to fetch keys learns nothing new. Every organization is a tenancy boundary and membership travels in the token. What IAM does not do is decide what you may reach once you are through the door. That is Authz, reading the same token.