FAQ
Questions deserve clear answers.
These answers describe the Lucion Identity General Availability service and distinguish live capabilities from independently gated server capabilities.
Lucion Identity is the shared identity, organization, authorization, developer-access, and audit layer designed for Lucion and Helios products.
A Lucion ID is the individual account that carries profile, language, time zone, security settings, devices, organization memberships, app permissions, and consent across supported Lucion experiences.
Yes. After you verify your email, you can create a password-based Lucion ID and use that password as a full sign-in method. Passkeys remain available when you want the convenience of device-based sign-in.
Organizations can be modeled with members, groups, roles, app access, policies, verified domains, invitations, and audit history so access follows the company structure instead of being recreated app by app.
Lyra is designed to use delegated authorization. A request must be tied to a user, organization, approved application, required scopes, and an auditable outcome rather than receiving universal access.
Yes. Identity Developer defines application registration, exact redirect URIs, scopes, OAuth/OIDC, signed ID tokens, webhooks, and API contracts. Production credentials remain hash-only and are shown only once.
Lucion Identity is designed to minimize identity data and make access visible and revocable. The service does not use identity data for advertising, and the approved privacy policy governs production data handling.
Helios Identity is intended to be the Helios-facing identity experience powered by Lucion Identity, avoiding a second disconnected authentication and authorization system.
The production model requires revocation to invalidate the relevant session, app consent, membership, or delegated authorization and record the change in the audit trail.
Server-backed organization management, replay-safe verified-domain lifecycle, member and group lifecycle controls, policy enforcement with optional session binding for sensitive reads and mutations, time-limited scoped delegated administration with a server-backed console, a server-backed approval console with step-up and separation of duties, replay-safe federation connection lifecycle, bounded provider metadata preflight, paginated tenant-bound audit and approval reads, organization-scoped SCIM user/group provisioning with ETag-based stale-writer protection, complete TypeScript, Python, and Go organization plus SCIM user/group lifecycle and discovery helpers, and the documented server-side developer quickstart are available in v6.6.2. Confidential OIDC applications also support owner-managed verified-email access lists; changing the list revokes existing app tokens. Tenant-isolation evidence is published separately and still distinguishes automated checks from authenticated multi-tenant and independent assurance work. Inbound OIDC is enabled behind its independent gate; SAML assertion execution and external federation conformance remain separately gated.