Considered at
every layer.
From the first sign-in to an application integration, the pieces have clear responsibilities.
Accounts and access
A shared account with access controlled separately for each project.
- Open, invitation-based or administrator-assigned project admission, with separate memberships.
- Email and password sign-in, with optional Google sign-in and project-bound passkeys where enabled.
- Profile and avatar management, session revocation and eligible account deletion.
- Administrator project management, invitations, and CSV preview and import.
Authentication and recovery
Projects choose the protection their users need.
- Disabled, optional or required multi-factor authentication policies for each project.
- Authenticator enrollment and single-use recovery codes, with project-specific verification.
- Opt-in assisted MFA recovery with independent administrator approval and identity checks.
Google connections
Shared providers with project-specific permissions and user consent.
- Administrators can share Google providers while configuring access and scopes per project.
- Named Contacts, Calendar, Drive and Gmail operations run through the central service when authorized.
- Existing accounts require explicit linking; users can manage and disconnect their Google access.
Developer integration
Connect applications using established identity protocols and practical integration resources.
- OpenID Connect discovery, authorization code flow with PKCE, userinfo and token introspection.
- API documentation, downloadable OpenAPI definitions and AI integration prompts.
- ChitraElements React integration for host applications using backend sessions.