2FA(Two-Factor Authentication)
Authentication requiring exactly two independent factor types, such as a password and a security key.
Glossary
Learn the key terms and concepts in authentication and user management.
#
A
ABAC(Attribute-Based Access Control)
An authorization model that evaluates attributes of subjects, resources, actions, and context against policies.
Access Certification
A formal attestation that user entitlements remain appropriate and compliant.
Access Review
A periodic check that asks responsible people to confirm or remove existing access.
Access Token
A credential presented to an API to authorize specific actions for a limited time and scope.
Account Linking
Connecting multiple login identities to one user profile while preventing unauthorized merges.
Account Takeover(ATO)
Unauthorized control of an account obtained through stolen credentials, session theft, social engineering, or recovery abuse.
ACL(Access Control List)
A list attached to a resource that specifies which identities may perform which actions.
Adaptive Authentication
Authentication that changes its requirements based on signals such as device, location, behavior, and transaction risk.
Agentic Identity
An identity representing an AI agent, including its owner, delegated authority, tools, and audit context.
Anomalous Login
A sign-in that differs from established patterns in device, location, time, network, or behavior.
API Key
A secret value that identifies and often authorizes an application calling an API.
Audience
The intended recipient of a token; services reject tokens not issued for their audience.
Audit Log
A tamper-resistant chronological record of identity, administrative, and access events.
Auth(Authentication)
Auth, short for authentication, is the process of verifying that a user, device, or service is who it claims to be before granting access to an application. In practice “auth” covers the whole identity layer: authenticating users, managing sessions and tokens, and authorizing what each identity can do.
Authenticator App
An application that verifies sign-ins using TOTP codes, push approvals, or device-bound cryptographic credentials.
Authorization
The process of deciding whether an authenticated identity may perform an action on a resource.
Authorization Code
A short-lived, single-use code exchanged by a client for tokens after user authorization.
Authorization Policy
A rule or set of rules that determines when access to a resource should be allowed or denied.
B
B2B Authentication
Authentication designed for business customers, including organizations, invitations, enterprise SSO, and tenant-scoped access.
Bearer Token
A token that grants access to whoever possesses it, making secure storage and transport essential.
Biometric Authentication
Identity verification using physical or behavioral traits such as a fingerprint, face, voice, or typing pattern.
Bot Detection
Identifying and controlling automated traffic that targets registration, login, recovery, or account APIs.
Breached Password Detection
Checking proposed or existing passwords against known compromised credential data.
Break-Glass Account
A tightly controlled emergency account used when normal administrative access is unavailable.
Brute-Force Attack
Repeated attempts to guess a password, code, key, or other authentication secret.
C
CIAM(Customer Identity & Access Management)
CIAM (Customer Identity and Access Management) is the practice and technology for managing the identities of an application's external end users — how they sign up, log in, and manage their accounts — at scale, with strong security, a smooth experience, and privacy compliance.
Claim
A named statement about an identity or token, such as subject, email, issuer, audience, or role.
Client Credentials Grant
An OAuth flow where a confidential application authenticates itself to access resources without a user.
Client Secret
A confidential credential an OAuth client uses to authenticate to an authorization server.
Compliance
Adherence to legal, regulatory, contractual, and internal security requirements.
Consent Management
Recording and enforcing what personal data a user has agreed may be collected or used.
Contextual Access
Access control that considers runtime context such as device posture, network, time, location, and risk.
Credential
Evidence used to prove identity, including passwords, passkeys, certificates, security keys, and biometric templates.
Credential Rotation
Replacing credentials on a schedule or after an event to limit exposure from compromise.
Credential Stuffing
Automated attempts to reuse username and password pairs stolen from other services.
CSRF(Cross-Site Request Forgery)
An attack that tricks a signed-in browser into sending an unintended request to a trusted site.
D
Data Residency
Requirements controlling the geographic locations where identity data is stored or processed.
Delegated Administration
Granting limited identity-management powers to local administrators without giving system-wide control.
Delegated Authorization
A user granting an application or agent limited permission to act on their behalf.
Deny by Default
A security posture where access is blocked unless an explicit rule allows it.
Deprovisioning
Disabling accounts, sessions, and access when an identity no longer needs them.
Device Authorization Grant
An OAuth flow for input-constrained devices where a user completes authorization on a separate device.
Directory Service
A system that stores and organizes users, groups, devices, and other identity records.
Directory Sync
Automated synchronization of users, groups, and attributes between an authoritative directory and applications.
Domain Discovery
Using an email domain or organization hint to find the correct enterprise identity provider.
Dormant Account
An account that has not been used for a defined period and may present unnecessary risk.
DPoP(Demonstrating Proof of Possession)
An OAuth mechanism that binds tokens to a client's cryptographic key to reduce token replay.
E
Enterprise SSO
Federated sign-in that lets an organization's workforce access external applications through its corporate identity provider.
Entitlement
A grant of access to an application, feature, data set, role, or permission.
F
FGA(Fine-Grained Authorization)
Authorization that makes resource-level decisions using detailed roles, attributes, or relationships.
FIDO2(Fast Identity Online 2)
Open standards for phishing-resistant authentication using public-key credentials stored on a user device or security key.
G
GDPR(General Data Protection Regulation)
European privacy law governing lawful, transparent, and secure processing of personal data.
Group
A collection of identities managed together for access assignment, policy, or communication.
H
HIPAA(Health Insurance Portability and Accountability Act)
A US law that includes safeguards for protected health information and access to it.
Home Realm Discovery(HRD)
The process of determining which identity provider should authenticate a user.
HRIS(Human Resources Information System)
A workforce system often used as the authoritative source for employee identity lifecycle events.
I
IAM(Identity & Access Management)
IAM (Identity and Access Management) is the framework of policies and technologies that ensures the right identities have the right access to the right resources at the right time. It covers how users are created, authenticated, authorized, and audited across an organization's applications and systems.
ID Token
An OIDC token containing claims about an authenticated user and the event that authenticated them.
Identity Federation
A trust arrangement that lets identities authenticated in one domain access services in another.
Identity Lifecycle Management(ILM)
Processes that govern creation, changes, access, and removal of digital identities over time.
Identity Proofing
Establishing that a person is who they claim to be using authoritative evidence and verification.
Identity Provider(IdP)
A trusted service that authenticates identities and issues assertions or tokens to applications.
Identity Verification
Checking identity evidence such as documents, biometrics, databases, or verified accounts.
IdP Routing
Rules that direct users to the correct identity provider based on domain, tenant, network, or context.
IGA(Identity Governance and Administration)
Processes and tools for governing identity lifecycles, entitlements, access requests, reviews, and compliance.
Impossible Travel
A risk signal triggered when sign-ins occur too far apart to be physically possible in the elapsed time.
Inherence Factor
An authentication factor based on something a user is, such as a fingerprint or face.
Issuer
The authority that creates and signs an identity assertion or security token.
ITDR(Identity Threat Detection and Response)
Detection and response focused on attacks against identities, credentials, sessions, and identity infrastructure.
J
JIT Provisioning(Just-in-Time Provisioning)
Automatic account creation at first federated sign-in using claims supplied by an identity provider.
Joiner-Mover-Leaver(JML)
A lifecycle model for changing identity access when people join, change roles, or leave.
Just-in-Time Access(JIT Access)
Temporary privileged access granted only when requested and automatically removed after a set period.
JWK(JSON Web Key)
A JSON representation of a cryptographic key used to sign or verify tokens.
JWKS(JSON Web Key Set)
A published collection of JSON Web Keys that clients use to verify token signatures.
JWT(JSON Web Token)
A compact, signed format for transferring claims between parties, often used for identity and access tokens.
K
Knowledge Factor
An authentication factor based on something a user knows, such as a password or PIN.
L
LDAP(Lightweight Directory Access Protocol)
A protocol for querying and modifying hierarchical directory services.
Least Privilege
The principle of granting identities only the minimum access needed, for only as long as needed.
M
Machine Identity
A digital identity representing software, devices, containers, services, or automated workloads.
Magic Link
A time-limited sign-in link sent to a verified channel, commonly email, that authenticates without a password.
MCP Authentication(Model Context Protocol Authentication)
MCP authentication is how a Model Context Protocol (MCP) server verifies the identity of an AI client and the user it acts for, then authorizes exactly which tools and data that client may access. It applies OAuth 2.1 patterns to AI agents so their access is scoped, revocable, and auditable.
MCP Server(Model Context Protocol Server)
A service exposing tools or data to AI clients through the Model Context Protocol.
MFA(Multi-Factor Authentication)
MFA (Multi-Factor Authentication) is a security method that requires a user to present two or more independent factors to prove their identity before access is granted. Because an attacker would need to compromise multiple factors, MFA dramatically reduces the risk of account takeover.
MFA Fatigue
Repeated push prompts intended to pressure a user into approving a fraudulent sign-in.
mTLS(Mutual TLS)
TLS where client and server both present certificates, enabling strong two-way workload authentication.
Multi-Tenant Auth(Multi-Tenant Authentication)
Multi-tenant authentication is an identity architecture that isolates users, roles, and settings per organization (tenant) within a single application. Each customer company gets its own directory, access policies, and SSO connection, while sharing one underlying codebase and deployment.
N
Non-Human Identity(NHI)
An identity used by software or automation rather than a person, such as a service account or agent.
Nonce
A unique value used once to bind protocol messages and prevent replay attacks.
O
OAuth 2.0(Open Authorization 2.0)
A framework that lets applications obtain limited access to protected resources without receiving a user's password.
OAuth Resource Server
An API that accepts access tokens and protects resources according to their scopes and claims.
OIDC(OpenID Connect)
An identity layer on OAuth 2.0 that lets clients verify users and receive standardized identity claims.
On-Behalf-Of Flow(OBO Flow)
A token flow where a service exchanges a user's token to call another service for that user.
Organization
A first-class grouping of users, roles, domains, and enterprise connections in a B2B application.
Organization Membership
The relationship connecting a user to an organization with tenant-scoped roles and attributes.
Orphaned Account
An account that remains active after its owner leaves or no longer has a valid business need.
P
PAM(Privileged Access Management)
Controls for securing, approving, monitoring, and auditing access to high-privilege accounts.
PAP(Policy Administration Point)
The interface or service where authorization policies are created, tested, and managed.
Passkey
A phishing-resistant credential based on FIDO2 that uses public-key cryptography and unlocks with a device or biometric.
Password Spraying
Trying a small set of common passwords against many accounts to avoid lockouts.
Passwordless Authentication
Authentication that replaces passwords with passkeys, magic links, one-time codes, biometrics, or trusted devices.
PDP(Policy Decision Point)
The component that evaluates access requests against policy and produces an authorization decision.
PEP(Policy Enforcement Point)
The component that intercepts a request and enforces the policy decision.
Permission
A named allowance to perform a specific action, such as reading invoices or inviting members.
Phishing
Deceptive communication or websites designed to steal credentials, sessions, or authorization.
Phishing-Resistant Authentication
Authentication designed not to reveal reusable secrets to fraudulent sites, typically using FIDO2 or certificates.
PIM(Privileged Identity Management)
Time-bound activation and governance of privileged roles for eligible identities.
PKCE(Proof Key for Code Exchange)
An OAuth extension that binds an authorization request to its token exchange and prevents intercepted-code attacks.
Policy as Code
Managing security and authorization rules as versioned, testable, deployable code.
Policy Engine
Software that evaluates authorization policies and returns allow or deny decisions.
Possession Factor
An authentication factor based on something a user has, such as a phone or security key.
Privilege Escalation
The acquisition of permissions beyond those originally granted, whether authorized or malicious.
Provisioning
Creating accounts and assigning initial access when an identity joins an organization or application.
Push Authentication
An authentication method that asks a registered device to approve or deny a sign-in request.
R
RBAC(Role-Based Access Control)
RBAC (Role-Based Access Control) is an authorization model that grants permissions to roles rather than directly to users, then assigns users to roles. A user's access is the sum of their roles' permissions, which makes access consistent, easy to manage, and simple to audit.
ReBAC(Relationship-Based Access Control)
An authorization model that derives access from relationships between users, groups, and resources.
Recovery Code
A single-use backup code that restores account access when a primary authentication factor is unavailable.
Redirect URI
A pre-registered client address where an authorization server sends the browser after authorization.
Refresh Token
A long-lived credential used to obtain new access tokens without asking the user to authenticate again.
Replay Attack
Reusing a captured valid message, code, assertion, or token to gain unauthorized access.
Risk-Based Authentication
Authentication that calculates sign-in risk and applies controls proportionate to that risk.
Role
A named bundle of permissions assigned to users, groups, or workloads.
S
SAML(Security Assertion Markup Language)
An XML-based federation standard commonly used to exchange authentication and authorization data for enterprise SSO.
SAML Assertion
A signed XML message carrying authentication and attribute statements from an IdP to a service provider.
SCIM(User Provisioning)
SCIM (System for Cross-domain Identity Management) is an open standard for automatically syncing user accounts and groups between an identity provider and an application. It lets IT create, update, and deactivate users in your app automatically as changes happen in their directory.
SCIM Endpoint
An application's standards-based API for creating, reading, updating, and deactivating identities.
SCIM Group
A standardized SCIM resource representing a collection of users and their membership.
SCIM Schema
The standardized attributes and extension model used to represent users and groups in SCIM.
Scope
A bounded permission requested by a client and represented in an access token.
Secrets Management
Secure storage, distribution, rotation, and auditing of passwords, API keys, certificates, and other secrets.
Self-Service Account Management
Tools that let users update profiles, credentials, factors, sessions, and recovery settings themselves.
Separation of Duties(SoD)
A control that divides sensitive tasks among multiple people to prevent conflicts and abuse.
Service Account
A non-human account used by an application or workload to access systems and APIs.
Service Provider(SP)
An application that relies on an identity provider to authenticate users, especially in SAML federation.
Session Hijacking
Taking over an authenticated session by stealing or manipulating its identifier or token.
SIM Swap
Fraudulent transfer of a phone number to capture SMS codes and account recovery messages.
SOC 2(System and Organization Controls 2)
An assurance framework evaluating controls for security, availability, processing integrity, confidentiality, and privacy.
Social Login
Authentication through a consumer identity provider such as Google, Apple, GitHub, or Microsoft.
SPIFFE(Secure Production Identity Framework for Everyone)
A standard for issuing interoperable, short-lived identities to workloads across heterogeneous infrastructure.
SPIRE(SPIFFE Runtime Environment)
An implementation of SPIFFE that performs workload attestation and issues identity documents.
SSO(Single Sign-On)
SSO (Single Sign-On) is an authentication method that lets a user log in once with a single set of credentials and access multiple applications without signing in again. A central identity provider authenticates the user and issues trusted tokens to each connected app.
State Parameter
An OAuth value used to preserve request state and defend redirect flows against cross-site request forgery.
Step-Up Authentication
A request for stronger authentication when a user attempts a sensitive action or risk increases.
T
Tenant
An isolated customer organization with its own members, identity settings, policies, and data.
Token Binding
Cryptographically tying a token to a client, key, or channel so a stolen token cannot be replayed elsewhere.
Token Exchange
A protocol for trading one security token for another with different audience, scope, or identity context.
Token Introspection
An OAuth endpoint that reports whether a token is active and returns its authorized metadata.
Token Revocation
The invalidation of an access or refresh token before its normal expiration.
Token Theft
Unauthorized acquisition of an access, refresh, identity, or session token.
TOTP(Time-Based One-Time Password)
A short-lived code generated from a shared secret and current time, usually by an authenticator app.
U
UEBA(User and Entity Behavior Analytics)
Analytics that identify suspicious activity by comparing behavior with established user and entity patterns.
Upstream IdP
An external identity provider trusted by another identity platform to authenticate users.
User Profile
The set of attributes and preferences associated with a digital identity.
W
WebAuthn(Web Authentication API)
A browser standard that lets websites authenticate users with passkeys and hardware security keys.
Workforce Identity
Identity and access management for employees, contractors, partners, and internal systems.
Workload Identity
A verifiable identity assigned to a deployed workload instead of relying on stored long-lived secrets.
Workload Identity Federation
Exchanging trusted platform identity for short-lived cloud credentials without storing static keys.
X
XSS(Cross-Site Scripting)
Injection of script into a trusted page, often enabling session or token theft.
Z
Zero Trust
A security model that continuously verifies each access request instead of trusting network location.
Add auth to your app in minutes
Authentication, SSO, MFA, RBAC, SCIM, and multi-tenant identity — with developer-first APIs and a console non-devs can use.