| Setting | Lucion behavior |
|---|---|
| RP ID | Configured AUTH_RP_ID; production is identity.lucionglobal.com. |
| Expected origin | Configured AUTH_EXPECTED_ORIGIN; production is https://identity.lucionglobal.com. |
| User verification | Required for registration, authentication, and step-up. |
| Challenge | Server-generated, purpose-bound, one-time, and expiry-limited. |
| Credential custody | Public-key credential material only; no private key or biometric template. |
Client requests optionsAuthenticator signs challengeServer verifies origin + RP + challengeCredential/session result
Browserregistration/optionsLucion Identity
Lucion Identityone-time challengeBrowser
BrowserchallengeAuthenticator
Authenticatorsigned assertionBrowser
BrowserassertionLucion Identity