MFA, everywhere
where the value is.
TOTP, WebAuthn, push, SMS, email — every factor. Step-up at the route, action, or risk-score level. The friction lives where the value does.
MFA shouldn't be everywhere. It should be somewhere.
Every factor, one interface
TOTP, WebAuthn passkeys, push, SMS, email, backup codes. Add a method without a migration.
Step-up, not always-on
Require fresh MFA at sensitive routes — not at every login. Define inline, evaluate at the edge.
requireFresh() · per-route, per-actionRisk signals you don't code
Geo, device, velocity, route — Authaz combines them into a score. You set the threshold; we route the user.
Six methods. Mix and match per tenant.
Defaults at the platform, overrides per org. Acme requires WebAuthn; Forge requires nothing yet. Same code path, different policy.
TOTP
Authenticator apps — Google, 1Password, Authy.
WebAuthn
Passkeys, security keys, Touch ID, Windows Hello.
Push
One-tap approval from your own mobile app.
SMS · OTP
Falls back when nothing else is enrolled. Rate-limited, geo-fenced.
Email · OTP
For low-risk surfaces or device recovery. Tokens expire in 10 minutes.
Backup codes
10 single-use codes for the day someone loses their phone.
Step-up MFA, made trivial.
Score every request, gate the dangerous ones.
Authaz reads device, geo, IP, route, and behavior — produces a risk score — and challenges only when the score crosses your bar. New device + sensitive route → step up. Everyday read → no friction.
- signals from device + geo + ip + route + velocity
- tunable thresholds per route
- edge-evaluated · no extra hop
Enrollment that finishes itself.
Hosted enrollment for every factor, themed to your brand. Users finish in under 90 seconds median. We track drop-off, you get the report.
- hosted or embedded React component
- recovery + backup codes built in
- cohort dashboard for adoption
One line in the route, not a refactor.
Drop requireFresh at the top of any handler. Define which factors are acceptable, how recent the proof must be, and what to do on failure.
- per-route · per-action · per-resource
- configurable max-age
- declarative, not state-machine
The fine print, up front.
One platform. Every primitive.
Every Authaz product shares the same primitives — sessions, policies, audit, tenants. Pick what you need today; add the rest when you do.
Authentication Flows
Password, magic code/link, and social login out of the box.
Admin & Dashboard Access
Authentication that works for back-office and internal tools.
RBAC & Permissions
Role-based access controls for customer and admin surfaces.
Strong factors. Where they earn their keep.
Step-up MFA, risk-aware, edge-evaluated. Friction only when the value justifies it.