id
doxanh IdentitySecure access layer

Application access required

Start this flow from an approved application so the redirect and client can be verified.

Approved appsRedirects and origins are checked before a session is issued.
Short-lived accessCode and magic-link challenges expire quickly by design.
Operational controlAdmins can tune delivery, domain, and abuse policies per app.