eQuantic Auth
Identity for humans,services and AI agents.
Identity for humans,services and AI agents.
A standards-first identity provider you install into your own .NET host with one call. Passkeys before passwords, no legacy grants to keep secure forever — and no per-user pricing.
PKCE S256 only
RFC 9700 audited
OWASP ASVS L2
.NET 10 · PostgreSQL
PKCE S256 only
RFC 9700 audited
OWASP ASVS L2
.NET 10 · PostgreSQL
AUTHENTICATION FLOWsign-in · id.acme.com
Assurance
—
Flow startedNo identifier yet — enumeration has nothing to probe
waiting
PasskeyWebAuthn · user verified · AAL2 on its own
·
Consentopenid · profile · invoices:read
·
Tokens issuedAccess · rotating refresh · id token
·
Access token · decodedpending
{"iss": "https://id.acme.com",
"sub": "0199c2e4-7b1a-7c3e-9f2d…",
"aud": "invoices-api",
"org": "acme",
"role": "owner",
"scope": "openid profile invoices:read",
"cnf": { "x5t#S256": "bwcK0esc3A…" }
eQuantic Auth
Identity for humans,services and AI agents.
Identity for humans,services and AI agents.
A standards-first identity provider you install into your own .NET host with one call. Passkeys before passwords, no legacy grants to keep secure forever — and no per-user pricing.
PKCE S256 only
RFC 9700 audited
OWASP ASVS L2
.NET 10 · PostgreSQL
PKCE S256 only
RFC 9700 audited
OWASP ASVS L2
.NET 10 · PostgreSQL
AUTHENTICATION FLOWsign-in · id.acme.com
Assurance
—
Flow startedNo identifier yet — enumeration has nothing to probe
waiting
PasskeyWebAuthn · user verified · AAL2 on its own
·
Consentopenid · profile · invoices:read
·
Tokens issuedAccess · rotating refresh · id token
·
Access token · decodedpending
{"iss": "https://id.acme.com",
"sub": "0199c2e4-7b1a-7c3e-9f2d…",
"aud": "invoices-api",
"org": "acme",
"role": "owner",
"scope": "openid profile invoices:read",
"cnf": { "x5t#S256": "bwcK0esc3A…" }
01
Agent-ready identityAI agents are first-class clients. They register themselves, act on a person's behalf through token exchange, and ask that person before anything irreversible.
02
Passwordless-firstPasskeys are the primary credential. Magic links and one-time codes are the fallback. Passwords are supported — never required.
03
OAuth 2.1 as the baselinePKCE on every authorization request, S256 only. No implicit, no hybrid, no password grant — not even behind a flag.
04
Authority only narrowsStatement-based permissions with one-way wildcards. A request that would widen access is refused outright — never quietly trimmed to fit.
01
Agent-ready identityAI agents are first-class clients. They register themselves, act on a person's behalf through token exchange, and ask that person before anything irreversible.
02
Passwordless-firstPasskeys are the primary credential. Magic links and one-time codes are the fallback. Passwords are supported — never required.
03
OAuth 2.1 as the baselinePKCE on every authorization request, S256 only. No implicit, no hybrid, no password grant — not even behind a flag.
04
Authority only narrowsStatement-based permissions with one-way wildcards. A request that would widen access is refused outright — never quietly trimmed to fit.
01
Agent-ready identityAI agents are first-class clients. They register themselves, act on a person's behalf through token exchange, and ask that person before anything irreversible.
02
Passwordless-firstPasskeys are the primary credential. Magic links and one-time codes are the fallback. Passwords are supported — never required.
03
OAuth 2.1 as the baselinePKCE on every authorization request, S256 only. No implicit, no hybrid, no password grant — not even behind a flag.
04
Authority only narrowsStatement-based permissions with one-way wildcards. A request that would widen access is refused outright — never quietly trimmed to fit.
INSTALLThe API and the screens never reference each other, so installing one never drags in the other. Take the shape that fits your host.
Three packages. One call in, one call out.
Three packages. One call in, one call out.
LEFT TO YOU, ON PURPOSEYour logger, where telemetry is exported, and whether the OpenAPI document gets a UI. The server instruments everything and picks none of them for you.
$ dotnet add package eQuantic.Auth
using eQuantic.Auth.Hosting; builder.Services.AddAuthServer(builder.Configuration, builder.Environment, auth => auth .WithPages(pages => pages.WithBrand("Acme ID"))); var app = builder.Build();app.UseAuthServer();app.Run();
OAuth 2.1 and OpenID Connect provider on OpenIddict
Sign-in, second factor, consent and device confirmation
E-mail verification, password reset, branded 404 and 500
OAuth 2.1 and OpenID Connect provider on OpenIddict
Sign-in, second factor, consent and device confirmation
E-mail verification, password reset, branded 404 and 500
LEFT TO YOU, ON PURPOSEYour logger, where telemetry is exported, and whether the OpenAPI document gets a UI. The server instruments everything and picks none of them for you.
$ dotnet add package eQuantic.Auth
using eQuantic.Auth.Hosting; builder.Services.AddAuthServer(builder.Configuration, builder.Environment, auth => auth .WithPages(pages => pages.WithBrand("Acme ID"))); var app = builder.Build();app.UseAuthServer();app.Run();
OAuth 2.1 and OpenID Connect provider on OpenIddict
Sign-in, second factor, consent and device confirmation
E-mail verification, password reset, branded 404 and 500
OAuth 2.1 and OpenID Connect provider on OpenIddict
Sign-in, second factor, consent and device confirmation
E-mail verification, password reset, branded 404 and 500
AGENT-READY IDENTITYAn AI agent gets the same protocol a first-party app does — and the same rule every token lives by: authority only narrows.
Agents are clients, not a workaround.
Agents are clients, not a workaround.
AN INVOICE AGENT PAYS A BILL FOR ADA
1
AgentYour API
GET /.well-known/oauth-protected-resourceLearns which authorization server guards the APIRFC 9728
2
AgenteQuantic Auth
POST /connect/registerA client_id and a registration token — shown once, stored as a hashRFC 7591
3
AgenteQuantic Auth
POST /connect/token grant_type=token-exchangeActs for Ada, narrowed to invoices:pay — asking for more is refusedRFC 8693
4
eQuantic AuthAda
Backchannel authentication request"Approve paying €1,240 to Northwind?" on her phoneOpenID CIBA
5
AgentYour API
POST /invoices/8841/payThe token speaks for one organization, and the act claim names the agentBearer
Step 2 · self-registration, no credentials needed
curl -X POST https://id.acme.com/connect/register \ -H 'Content-Type: application/json' \ -d '{"client_name":"Invoice Agent", "redirect_uris":["http://localhost:8080/callback"], "token_endpoint_auth_method":"none", "scope":"openid profile"}'
201
{ "client_id": "…", "registration_access_token": "eqa_reg_…" }
Scopes the size of a toolGrant an agent invoices:read and that is where it stays. Asking for more is refused at the token endpoint, and the act claim names the agent in every token it holds for someone else.
AN INVOICE AGENT PAYS A BILL FOR ADA
1
AgentYour API
GET /.well-known/oauth-protected-resourceLearns which authorization server guards the APIRFC 9728
2
AgenteQuantic Auth
POST /connect/registerA client_id and a registration token — shown once, stored as a hashRFC 7591
3
AgenteQuantic Auth
POST /connect/token grant_type=token-exchangeActs for Ada, narrowed to invoices:pay — asking for more is refusedRFC 8693
4
eQuantic AuthAda
Backchannel authentication request"Approve paying €1,240 to Northwind?" on her phoneOpenID CIBA
5
AgentYour API
POST /invoices/8841/payThe token speaks for one organization, and the act claim names the agentBearer
Step 2 · self-registration, no credentials needed
curl -X POST https://id.acme.com/connect/register \ -H 'Content-Type: application/json' \ -d '{"client_name":"Invoice Agent", "redirect_uris":["http://localhost:8080/callback"], "token_endpoint_auth_method":"none", "scope":"openid profile"}'
201
{ "client_id": "…", "registration_access_token": "eqa_reg_…" }
Scopes the size of a toolGrant an agent invoices:read and that is where it stays. Asking for more is refused at the token endpoint, and the act claim names the agent in every token it holds for someone else.
DESIGN STANCEIf a setting can be misconfigured into an insecure state, the default is wrong. So some things are always on — and some never ship at all.
Secure by default, not by configuration.
Secure by default, not by configuration.
NEVER SHIPPEDNot even behind a flag
Implicit
grant
Hybrid
flow
Password
grant
(ROPC)
PKCE
with
the
plain
method
Fragment
response
mode
Accounts
matched
by
e-mail
from
a
provider
Just-in-time
accounts
without
a
verified
domain
ALWAYS ONFrom the first request
PKCE on every request, S256 only
A request without a code challenge never receives a code.
Exact redirect URI matching
Plain http only on loopback. No open redirectors.
Code replay revokes the grant
Replay a code and the refresh token from its first use dies too.
Refresh rotation with reuse detection
Reuse revokes the whole token family.
Argon2id for passwords
Length is the only rule. A breached-password check is one switch away.
Server-side sessions
256-bit tokens, stored as SHA-256. 7 days sliding, 30-day ceiling.
Secrets shown once
Sessions, API keys and registration tokens exist only as hashes.
No framing, no referrer leaks
X-Frame-Options DENY and frame-ancestors none on every response.
Real keys, or no start
Production refuses to boot without real signing keys.
PKCE on every request, S256 only
A request without a code challenge never receives a code.
Exact redirect URI matching
Plain http only on loopback. No open redirectors.
Code replay revokes the grant
Replay a code and the refresh token from its first use dies too.
Refresh rotation with reuse detection
Reuse revokes the whole token family.
Argon2id for passwords
Length is the only rule. A breached-password check is one switch away.
Server-side sessions
256-bit tokens, stored as SHA-256. 7 days sliding, 30-day ceiling.
Secrets shown once
Sessions, API keys and registration tokens exist only as hashes.
No framing, no referrer leaks
X-Frame-Options DENY and frame-ancestors none on every response.
Real keys, or no start
Production refuses to boot without real signing keys.
PKCE on every request, S256 only
A request without a code challenge never receives a code.
Exact redirect URI matching
Plain http only on loopback. No open redirectors.
Code replay revokes the grant
Replay a code and the refresh token from its first use dies too.
Refresh rotation with reuse detection
Reuse revokes the whole token family.
Argon2id for passwords
Length is the only rule. A breached-password check is one switch away.
Server-side sessions
256-bit tokens, stored as SHA-256. 7 days sliding, 30-day ceiling.
Secrets shown once
Sessions, API keys and registration tokens exist only as hashes.
No framing, no referrer leaks
X-Frame-Options DENY and frame-ancestors none on every response.
Real keys, or no start
Production refuses to boot without real signing keys.
NEVER SHIPPEDNot even behind a flag
Implicit
grant
Hybrid
flow
Password
grant
(ROPC)
PKCE
with
the
plain
method
Fragment
response
mode
Accounts
matched
by
e-mail
from
a
provider
Just-in-time
accounts
without
a
verified
domain
ALWAYS ONFrom the first request
PKCE on every request, S256 only
A request without a code challenge never receives a code.
Exact redirect URI matching
Plain http only on loopback. No open redirectors.
Code replay revokes the grant
Replay a code and the refresh token from its first use dies too.
Refresh rotation with reuse detection
Reuse revokes the whole token family.
Argon2id for passwords
Length is the only rule. A breached-password check is one switch away.
Server-side sessions
256-bit tokens, stored as SHA-256. 7 days sliding, 30-day ceiling.
Secrets shown once
Sessions, API keys and registration tokens exist only as hashes.
No framing, no referrer leaks
X-Frame-Options DENY and frame-ancestors none on every response.
Real keys, or no start
Production refuses to boot without real signing keys.
PKCE on every request, S256 only
A request without a code challenge never receives a code.
Exact redirect URI matching
Plain http only on loopback. No open redirectors.
Code replay revokes the grant
Replay a code and the refresh token from its first use dies too.
Refresh rotation with reuse detection
Reuse revokes the whole token family.
Argon2id for passwords
Length is the only rule. A breached-password check is one switch away.
Server-side sessions
256-bit tokens, stored as SHA-256. 7 days sliding, 30-day ceiling.
Secrets shown once
Sessions, API keys and registration tokens exist only as hashes.
No framing, no referrer leaks
X-Frame-Options DENY and frame-ancestors none on every response.
Real keys, or no start
Production refuses to boot without real signing keys.
PKCE on every request, S256 only
A request without a code challenge never receives a code.
Exact redirect URI matching
Plain http only on loopback. No open redirectors.
Code replay revokes the grant
Replay a code and the refresh token from its first use dies too.
Refresh rotation with reuse detection
Reuse revokes the whole token family.
Argon2id for passwords
Length is the only rule. A breached-password check is one switch away.
Server-side sessions
256-bit tokens, stored as SHA-256. 7 days sliding, 30-day ceiling.
Secrets shown once
Sessions, API keys and registration tokens exist only as hashes.
No framing, no referrer leaks
X-Frame-Options DENY and frame-ancestors none on every response.
Real keys, or no start
Production refuses to boot without real signing keys.
A feature that cannot be integration-tested does not ship.The security BCP audit and the ASVS review are test suites, not PDFs — every flow runs end to end against PostgreSQL 17 in Testcontainers, and every deviation from a standard gets its own decision record.
dotnet test --filter SecurityBcpTests
A feature that cannot be integration-tested does not ship.The security BCP audit and the ASVS review are test suites, not PDFs — every flow runs end to end against PostgreSQL 17 in Testcontainers, and every deviation from a standard gets its own decision record.
dotnet test --filter SecurityBcpTests
STANDARDSThe bar is a passing conformance run, not a feature count. This is what ships today and what the certification track targets.
The standards, and where each one stands.
The standards, and where each one stands.
Shipped
Certification target
Next
STANDARDSThe bar is a passing conformance run, not a feature count. This is what ships today and what the certification track targets.
The standards, and where each one stands.
The standards, and where each one stands.
Shipped
Certification target
Next
PROTOCOL
OAuth 2.1The baseline, not a mode
OpenID ConnectCore, discovery, userinfo
RFC 7591 / 7592Dynamic client registration
RFC 9126Pushed authorization requests
RFC 9396Rich authorization requests
RFC 9207Issuer identification
MACHINES & AGENTS
RFC 8693Token exchange
RFC 8628Device authorization
OpenID CIBABackchannel approval
RFC 9728Protected resource metadata
RFC 8705Mutual-TLS bound tokens
DPoPWaiting on upstream support
Next
CREDENTIALS & ACCOUNTS
WebAuthn · FIDO2Passkeys as the primary credential
RFC 6238TOTP with recovery codes
Magic link · OTPE-mail and SMS codes
NIST 800-63BAssurance levels per flow
SCIM 2.0Provisioning per organization
SAMLEnterprise federation
Next
ASSURANCE
RFC 9700OAuth security BCP, audited
OWASP ASVS 5.0V6 and V7, levels 1 and 2
Basic OPOpenID certification
Target
Config OPOpenID certification
Target
Dynamic OPOpenID certification
Target
FAPI 2.0Security profile
Target
PROTOCOL
OAuth 2.1The baseline, not a mode
OpenID ConnectCore, discovery, userinfo
RFC 7591 / 7592Dynamic client registration
RFC 9126Pushed authorization requests
RFC 9396Rich authorization requests
RFC 9207Issuer identification
MACHINES & AGENTS
RFC 8693Token exchange
RFC 8628Device authorization
OpenID CIBABackchannel approval
RFC 9728Protected resource metadata
RFC 8705Mutual-TLS bound tokens
DPoPWaiting on upstream support
Next
CREDENTIALS & ACCOUNTS
WebAuthn · FIDO2Passkeys as the primary credential
RFC 6238TOTP with recovery codes
Magic link · OTPE-mail and SMS codes
NIST 800-63BAssurance levels per flow
SCIM 2.0Provisioning per organization
SAMLEnterprise federation
Next
ASSURANCE
RFC 9700OAuth security BCP, audited
OWASP ASVS 5.0V6 and V7, levels 1 and 2
Basic OPOpenID certification
Target
Config OPOpenID certification
Target
Dynamic OPOpenID certification
Target
FAPI 2.0Security profile
Target
PROTOCOL
OAuth 2.1The baseline, not a mode
OpenID ConnectCore, discovery, userinfo
RFC 7591 / 7592Dynamic client registration
RFC 9126Pushed authorization requests
RFC 9396Rich authorization requests
RFC 9207Issuer identification
MACHINES & AGENTS
RFC 8693Token exchange
RFC 8628Device authorization
OpenID CIBABackchannel approval
RFC 9728Protected resource metadata
RFC 8705Mutual-TLS bound tokens
DPoPWaiting on upstream support
Next
CREDENTIALS & ACCOUNTS
WebAuthn · FIDO2Passkeys as the primary credential
RFC 6238TOTP with recovery codes
Magic link · OTPE-mail and SMS codes
NIST 800-63BAssurance levels per flow
SCIM 2.0Provisioning per organization
SAMLEnterprise federation
Next
ASSURANCE
RFC 9700OAuth security BCP, audited
OWASP ASVS 5.0V6 and V7, levels 1 and 2
Basic OPOpenID certification
Target
Config OPOpenID certification
Target
Dynamic OPOpenID certification
Target
FAPI 2.0Security profile
Target
ORGANIZATIONS · B2BOne global account and one sign-in — with a separate identity inside every organization it belongs to. No token ever spans two.
A token speaks for exactly one organization.
A token speaks for exactly one organization.
01
Roles live on the membershipOne account and one sign-in — plus a separate identity inside each organization, with its own roles and enabled state. That membership is the resource SCIM provisions.
02
SSO per organizationJust-in-time accounts only where a DNS-verified domain vouches for the address. Identity stays provider plus subject, never the e-mail a provider reports.
03
Suspend without deletingA suspended organization confers no authority and accepts no changes — and stays visible to its members.
04
An audited side doororganizations:administer is granted to nobody by default, and every use lands in the customer's own audit trail.
AL
Ada LovelaceOne account · one passkey · two memberships
Token for Acme
owner
"org": "acme""role": "owner""scope": "invoices:*"
Token for Globex
member
"org": "globex""role": "member""scope": "invoices:read"
Token for Acme
owner
"org": "acme""role": "owner""scope": "invoices:*"
Token for Globex
member
"org": "globex""role": "member""scope": "invoices:read"
The Globex token asks for invoices:writeA member there, an owner elsewhere — authority never travels between organizations.
Refused, not trimmed
The Globex token asks for invoices:writeA member there, an owner elsewhere — authority never travels between organizations.
Refused, not trimmed
ORGANIZATIONS · B2BOne global account and one sign-in — with a separate identity inside every organization it belongs to. No token ever spans two.
A token speaks for exactly one organization.
A token speaks for exactly one organization.
01
Roles live on the membershipOne account and one sign-in — plus a separate identity inside each organization, with its own roles and enabled state. That membership is the resource SCIM provisions.
02
SSO per organizationJust-in-time accounts only where a DNS-verified domain vouches for the address. Identity stays provider plus subject, never the e-mail a provider reports.
03
Suspend without deletingA suspended organization confers no authority and accepts no changes — and stays visible to its members.
04
An audited side doororganizations:administer is granted to nobody by default, and every use lands in the customer's own audit trail.
AL
Ada LovelaceOne account · one passkey · two memberships
Token for Acme
owner
"org": "acme""role": "owner""scope": "invoices:*"
Token for Globex
member
"org": "globex""role": "member""scope": "invoices:read"
Token for Acme
owner
"org": "acme""role": "owner""scope": "invoices:*"
Token for Globex
member
"org": "globex""role": "member""scope": "invoices:read"
The Globex token asks for invoices:writeA member there, an owner elsewhere — authority never travels between organizations.
Refused, not trimmed
The Globex token asks for invoices:writeA member there, an owner elsewhere — authority never travels between organizations.
Refused, not trimmed
HOSTED SCREENSSign-in with its second-factor step-up, e-mail verification, password reset, consent and device confirmation ship as eQuantic UI components — in English and Portuguese, rebranded by your app's theme.Switch them off and the host answers exactly as it did before they existed. No flow lives only in a screen.
There when you want them. Gone when you don't.
There when you want them. Gone when you don't.
id.acme.com/signin
Acme ID
Sign in to AcmeUse your passkey — no password needed.Continue with a passkey
or
ada@acme.com
E-mail me a sign-in link
EN · PT-BR
id.acme.com/signin
Acme ID
Sign in to AcmeUse your passkey — no password needed.Continue with a passkey
or
ada@acme.com
E-mail me a sign-in link
EN · PT-BR
id.acme.com/signin
Acme ID
Sign in to AcmeUse your passkey — no password needed.Continue with a passkey
or
ada@acme.com
E-mail me a sign-in link
EN · PT-BR
id.acme.com/signin
Acme ID
Sign in to AcmeUse your passkey — no password needed.Continue with a passkey
or
ada@acme.com
E-mail me a sign-in link
EN · PT-BR
HOSTED SCREENSSign-in with its second-factor step-up, e-mail verification, password reset, consent and device confirmation ship as eQuantic UI components — in English and Portuguese, rebranded by your app's theme.Switch them off and the host answers exactly as it did before they existed. No flow lives only in a screen.
There when you want them. Gone when you don't.
There when you want them. Gone when you don't.
WHERE IT STANDSTrust gets earned where others can check it: certification, production and review by someone who is not us. That is the order of work.
Honest about what is done.
Honest about what is done.
Built
Running, integration-testedOAuth 2.1 and OpenID Connect provider with hosted screens
Passkeys, magic links, TOTP, e-mail and SMS codes on one flow engine
Organizations, per-organization SSO and SCIM provisioning
Token exchange, device grant, CIBA and API keys
Permissions, roles and an append-only security log
Audited impersonation, new-device and impossible-travel alerts
Next
In flight nowOpenID Basic, Config and Dynamic OP certification runs
eQuantic Accounts runs on it — the first production deployment
An external security review and a disclosure policy
Later
Queued, in this orderAdmin console
SAML federation
Client SDKs
Relationship-based access control
Built
Running, integration-testedOAuth 2.1 and OpenID Connect provider with hosted screens
Passkeys, magic links, TOTP, e-mail and SMS codes on one flow engine
Organizations, per-organization SSO and SCIM provisioning
Token exchange, device grant, CIBA and API keys
Permissions, roles and an append-only security log
Audited impersonation, new-device and impossible-travel alerts
Next
In flight nowOpenID Basic, Config and Dynamic OP certification runs
eQuantic Accounts runs on it — the first production deployment
An external security review and a disclosure policy
Later
Queued, in this orderAdmin console
SAML federation
Client SDKs
Relationship-based access control
Who it is forThe .NET team that wants its identity provider inside its own host — self-hosted, standards-first, agent-ready, batteries included and no per-user pricing. We will not claim to stand alongside the big platforms until the certification runs and an outside review say so.
Who it is forThe .NET team that wants its identity provider inside its own host — self-hosted, standards-first, agent-ready, batteries included and no per-user pricing. We will not claim to stand alongside the big platforms until the certification runs and an outside review say so.
Who it is forThe .NET team that wants its identity provider inside its own host — self-hosted, standards-first, agent-ready, batteries included and no per-user pricing. We will not claim to stand alongside the big platforms until the certification runs and an outside review say so.
FAQWhat security teams ask first
Early access
Our own stack, all the way down
Early access
Our own stack, all the way down
Early access
Our own stack, all the way down
Ready to ship something real?
Book a 30-minute discovery call. We'll tell you within the hour whether we're the right partner — or who is.
Ready to ship something real?
Book a 30-minute discovery call. We'll tell you within the hour whether we're the right partner — or who is.
Building enterprise-grade products, libraries and software that scale globally. A technology laboratory based in Portugal.
Building enterprise-grade products, libraries and software that scale globally. A technology laboratory based in Portugal.