Password & MFA
Password-based auth with optional second factor (TOTP, SMS, hardware key). Most common, well-understood, legacy support.
Supported
Connect enterprise sign-in to governed access.
Zoiko iD brings authentication context, federation, credentials, authority and auditable decisions into one programmable trust layer. Keep your existing identity systems and examine how identity evidence can inform access policy.
What is authentication & SSO?
Authentication confirms an actor's use of a valid authenticator (password, passkey, token, certificate). SSO (Single Sign-On) allows one login to grant access to multiple applications via federation protocols.
Authentication proves identity claim. Authorization still determines what the authenticated actor can do. Zoiko iD connects both with auditable evidence and policy.
Authentication methods & protocols
Passkeys
WebAuthn/FIDO2-based phishing-resistant authentication. Native biometric or hardware key. Next-generation standard.
Supported
OAuth 2.0 & OIDC
Federation via OAuth/OpenID Connect. Delegate to identity provider. Works with Okta, Azure AD, Google, GitHub, custom IdPs.
Supported
SAML 2.0
Enterprise federation standard. XML-based protocol. Common in on-prem and hybrid deployments. IdP-initiated or SP-initiated flows.
Supported
Certificates & mTLS
X.509 client certificates and mutual TLS. Common for service-to-service, machine workloads, and high-assurance environments.
Supported
Custom & Emerging
Proprietary flows, device attestation, step-up, and risk-based auth. Planned or custom implementation under evaluation.
Verify support
Core authentication outcomes
User Authenticated
Proof of valid authenticator use at a point in time.
Session Established
Authenticator proof is cached for reuse during session window.
Context Passed
Token or session reference flows to downstream app/policy.
Policy Decides Access
Authorization engine evaluates who can do what.
Federation & tenant boundaries
Overlay-first design
Zoiko iD sits between your identity provider and your application as an optional overlay. You keep your existing IdP (Okta, Azure AD, Ping). Zoiko iD receives signals from it, applies context, and passes decisions to policy engines.
- Multi-TenantTenant isolation preserved at all layers
- Cross-IdPWorks with any OAuth/SAML/OIDC provider
- No MigrationAdd without replacing existing IdP
MFA, assurance & step-up
Multi-Factor Authentication
Require password + something you have (TOTP app, security key, SMS). Reduces risk of password compromise.
Assurance Levels
Classify auth strength: low (password), medium (password + TOTP), high (passkey or hardware). Let policy require specific levels.
Step-Up Authentication
Initially authenticate at low assurance. If accessing sensitive resource, require step-up (e.g., re-auth with MFA) without full login.
Risk-Based Auth
Evaluate context (location, device, time, behavior anomalies). Require stronger auth if risk score is high.
Adaptive MFA
Adjust MFA requirement based on context. Low-risk = no prompt. High-risk = MFA required.
Session Re-Auth
Require periodic re-authentication on long-lived sessions. Configurable timeouts per resource sensitivity.
Identity is not authority
NOT Enough
- Knowing who someone is
- Proving they authenticated
- Verifying their claims
- Trusting their credentials
Still Required
- Explicit access policy
- Resource-level permissions
- Delegated authority proof
- Continuous reevaluation
Authentication provides identity context. Policy engines decide what authenticated users can do. Never conflate the two.
Sessions, trust & revocation
Session Timeout
Sessions expire after idle or absolute time. User must re-authenticate.
Explicit Revocation
Admin can revoke session immediately if user leaves org or compromised.
Continuous Trust
Monitor session signals (location, device) and re-evaluate trust during session.
User Terminated
Employee departing → all sessions revoked → access logs created.
Credential Revoked
Underlying credential (e.g., certificate, API key) revoked → new auth required.
Breach Detection
Compromise detected → invalidate sessions → force re-auth → audit trail.
Developer integration pathways
Deep Integration
Custom auth flows, policy evaluation, session management. APIs and webhooks for advanced use.
View APIs
Security & resilience
End-to-End Encryption
Authentication tokens, session IDs, and sensitive data encrypted in transit (TLS 1.3) and at rest.
CSRF & XSS Protection
Built-in protections against cross-site request forgery and script injection attacks.
Complete Audit Trail
Every login, session event, policy decision, and revocation is logged with timestamp and actor.
High Availability
Distributed architecture, automatic failover, geo-redundancy. 99.99% uptime SLA.
Tenant Isolation
Multi-tenant architecture with complete data isolation, no cross-tenant leakage.
Anomaly Detection
Machine learning-based detection of suspicious login patterns and credential abuse.
Frequently asked questions
Find answers to common questions about Zoiko iD
Do we have to replace our existing identity provider?
No. Zoiko iD sits between your identity provider and your application as an optional overlay. You keep your existing IdP, such as Okta, Azure AD or Ping, and add Zoiko iD without a migration.
Which authentication methods are supported?
Password with MFA, passkeys (WebAuthn/FIDO2), OAuth 2.0 and OpenID Connect, SAML 2.0, and X.509 certificates with mutual TLS. Custom and emerging flows such as device attestation are planned or under evaluation, so verify support for those first.
How is MFA or step-up handled?
Policy can require a specific assurance level. A user can sign in at low assurance and be asked to step up, for example by re-authenticating with MFA, only when accessing a sensitive resource. Adaptive MFA adjusts the requirement to the risk of the context.
What happens if authentication fails or is denied?
No session is established, so no identity context is passed to downstream applications or policy, and the attempt is recorded in the audit trail.
How long are authentication logs retained?
Every login, session event, policy decision and revocation is logged with a timestamp and actor. Retention periods depend on your plan and configuration; talk to our team for the details that apply to you.
Is authentication the same as authorization?
No. Authentication provides identity context: it proves who the actor is. Authorization is a separate step in which policy decides what that authenticated actor can do.
Ready to Connect authentication to governed access?
Bring authentication context into your identity and access control infrastructure with Zoiko iD.