Authentication verifies identities and controls access to the platform, covering user logins, API credentials, token rotation, and revocation to keep customer data secure.
Authentication is the process of verifying that someone is who they say they are before granting access to the platform. It covers everything from a user logging in on their laptop to a server-side integration authenticating with an API key. This deep dive explains how the platform handles authentication securely — including how access tokens work, how they're kept short-lived to limit risk, how they can be revoked instantly in an emergency, and how the underlying security keys are rotated safely over time.
Authentication is one of the most critical pieces of any software platform. A failure here — a leaked token, a compromised credential, an unrevokable session — can mean unauthorized access to your customers' data. Getting this right is fundamental to the security promises you make to customers.
Server-to-server integrations use client credentials — a client ID and secret. These work similarly to a username and password but are designed for programmatic use. Every token issued to a machine client is logged with the integration's identity and the IP address it came from.
The platform maintains a revocation list — a fast, real-time record of tokens that have been explicitly invalidated. Every token validation checks this list. If a token is on the list, it's rejected immediately, regardless of whether it would otherwise still be valid. This means:
- A compromised session can be terminated instantly by an administrator
- A departing employee's access is cut off the moment their account is deactivated
- An integration that's been compromised can be disabled immediately
The platform uses cryptographic keys to sign tokens — a way of mathematically proving that a token was issued by the platform and hasn't been tampered with. These keys need to be rotated periodically (replaced with new ones) as a security best practice.
Key rotation is handled carefully to avoid disrupting active sessions:
- New keys are published before old ones expire
- Tokens signed with old keys continue to work during a transition window
- Once the transition is complete, old keys are retired
- Key rotation events are logged and can trigger alerts
From the admin dashboard:
- Active sessions per user — and the ability to terminate any of them
- A log of recent authentication events: logins, token refreshes, failed attempts, revocations
- Alerts for suspicious activity (e.g., the same account logging in from two different countries in quick succession)
The team is building:
These improvements will harden the authentication layer significantly and give you verifiable, testable proof of the security controls you're promising to customers.