You sign in to Vault through Identity Studio, with OAuth 2.0 and PKCE, passkeys and number matching. Each app then carries a token or a device key that works for Vault alone.
via Identity Studioresponse_type=codecode_challenge_method=S256redirect_uri=http://127.0.0.1Why it matters
The same sign-in, step-up and audit trail protect the vault and every app around it.
A token issued for Vault is refused anywhere else, and anything else is refused by Vault.
Access tokens last 30 minutes; refresh tokens rotate, and reusing an old one ends the whole chain.
How it works
The exact mechanisms
Authorization code flow. PKCE is S256 only, plain is refused, and it is mandatory for public clients such as the Mac app and agents. Redirect URIs must match exactly. Codes and refresh tokens are stored hashed; ID tokens are signed RS256.
A token request names one resource registered to the app, and the token's audience is that resource. The Vault endpoint accepts only tokens whose audience is itself; any other target is invalid_target.
Refresh tokens rotate on every use. Presenting an old one revokes the whole chain and its session. Revocation (RFC 7009) ends the consent, every refresh grant, every credential grant and the session family, and answers the same for unknown tokens.
The Mac app and the credential bridge register their own public client (RFC 7591) and receive the code on a loopback address. Pairing a computer from a hosted client is refused.
Sign in to your vault's console with a passkey. User verification is required, so a passkey also proves it is you, and it counts as a step-up.
Step-up factors are a passkey, an authenticator code, a push to Vaarta Authenticator with number matching, or a recovery code. Revealing in the console needs a step-up no older than five minutes.
The Chrome extension is connected from your signed-in console after a fresh step-up and keeps a P-256 key it cannot export. Vaarta Authenticator keeps its key in the phone's hardware, behind your biometric.
Sign-in, sign-up and password reset run Vaarta's own check: a small SHA-256 proof-of-work in the browser, nothing to solve, no tracking, nothing sent to a third party. Each challenge is signed, single-use, five minutes long and bound to the page and host. Today it checks and records; blocking is switched on per deployment.
Policies
Built on Identity Studio and shared with every app it protects.
Rules on roles, people, email domains, time zones, IP ranges, weekdays, hours, an unknown IP or a new device, with the action allow, require MFA, block or notify. Rules are evaluated and recorded today; enforcement is early access.
An approximate city, region and country from the IP address, looked up offline, shown on your sessions and on the approval your phone sees. It is labelled approximate and is not used to decide access. IP geolocation by DB-IP.
The same invisible check protects any app on Identity Studio, and each app can choose it or another provider for its hosted pages.
In which planSign-in through Identity Studio comes with every plan.See plans →
See plansCreate your vault, link your phone, and bring everything in from where it lives today.