Security

Account SecurityBuilt Into the Platform

How AuthJet stores credentials, ends sessions and records every change, as its reference documents it.

Sessions are held by the server, so a sign-out ends a session at its next request, in every app the person reached.

New passwords are hashed with Argon2id. Imported bcrypt, PBKDF2 and Argon2id hashes keep working.

Authenticator secrets are sealed with AES-256-GCM. Recovery codes are stored as SHA-256 digests only.

A password reset request answers the same whether or not the address has an account.

Five wrong codes spend a sign-in challenge. Five in a row lock recovery and MFA changes for 15 minutes.

Every key, setting and rule change is recorded in a chain of digests you can verify end to end.

An account key is shown when it is made and stored as a digest. Revoke one and it stops at once.

Authenticator codes on any account, required of every member when the account says so.

Each key can carry its own requests per minute and a lifetime budget, refused with 429 past either.

A person can erase their own account and its sign-in records with one call.

A route marked verified refuses a person whose address is unproven, with 403 EMAIL_VERIFICATION_REQUIRED.

A password change ends every other session of the person. A reset ends all of them.

Frequently Asked Questions

Where are my users stored?

In your app's own store on Substrio, as its users collection.

Can apps share one Google or Apple registration?

Yes. The platform holds one shared registration at a provider, and every app without its own uses it.

Can I move my existing users?

Yes, with their bcrypt, PBKDF2 or Argon2id password hashes.

Which account do I sign up with?

Your Substrio account. One sign-in covers AuthJet, MapJet and SendJet.

Is there a separate AuthJet dashboard?

No. AuthJet is managed in the Substrio dashboard, beside every other Substrio app.