Curity Identity Server

Federates login with Google, Apple, Facebook, Microsoft, and other external identity providers via OIDC, returning normalized user attributes.

Supports passkey registration and authentication via the WebAuthn API, enabling biometric-authenticated, phishing-resistant login for consumer-facing applications.

Handles authentication and session management for millions of concurrent external users at low latency, sustaining consumer traffic spikes such as product launches and seasonal peaks.

Captures and stores user consent for data processing at the identity layer, integrated with the registration and preference management flows.

Verifies a real-world identity during registration or step-up, such as document or government-ID proofing and liveness checks, to establish trust for high-value consumer accounts before granting access.

Requests additional user attributes across multiple sessions rather than collecting a full profile at registration, reducing abandonment at the point of sign-up.

Manages OAuth 2.0 client credentials and JWT issuance for machine-to-machine API authentication, with rate limiting and scope enforcement.

Defines and enforces authorization policies that decide which users and machines can access which applications and APIs, evaluated at runtime alongside authentication.

Enforces externalized, fine-grained authorization policy using ABAC or RBAC for applications and APIs.

Implements SAML 2.0, OIDC, and OAuth 2.0 for SSO across SaaS and on-premises applications, with a pre-built application catalog and custom app support.

Provides phishing-resistant MFA such as FIDO2 and X.509, with protections against compromised passwords and common MFA attacks.

Supports FIDO2 hardware keys, platform biometrics (Touch ID, Windows Hello), and passkeys for phishing-resistant authentication without password entry.

Evaluates contextual risk signals (device fingerprint, geolocation, IP reputation, behavioral anomaly) at each authentication and step-up challenge request, applying stronger authentication when risk is elevated.

Provides low-code or no-code journey-time orchestration to customize and extend access flows.

Provides a directory or integrated identity repository with synchronization across all user constituencies.

Supports basic create, read, update and delete identity life-cycle operations across all user types.

Provides access management functions for machines, workloads, services and agentic AI.