RESOURCES
Security model
A developer-facing guide to Lucion Identity's implemented security boundaries.
Implemented controls
- HTTPS and exact production Origin validation.
- Authorization Code + PKCE with S256.
- WebAuthn challenge, origin, RP ID, and user-verification checks.
- Secure HttpOnly host-only sessions and CSRF protection.
- Hash-only API keys and one-time displayed secrets.
- Organization and application tenant isolation.
- Signed, timestamped, replay-resistant webhook delivery.
- Recovery that requires a replacement passkey and revokes prior sessions.
- Lyra delegation limited by user, organization, app, scope, policy, and step-up.