OAuth 2.0 / OIDC
ZKey works as a complete login provider for any app that supports standard OAuth or OpenID Connect. Plug it into Notion, Slack, a custom dashboard, or a mobile app — no custom code required. Every login flow is protected against token interception, and refresh tokens that get stolen trigger immediate automatic revocation across all sessions.
PKCE Authorization Flow
ZKey implements RFC 7636 Proof Key for Code Exchange. The client generates a random code_verifier, hashes it to code_challenge (SHA-256), and includes it in the authorization request. The server stores the challenge and verifies the verifier at token exchange — preventing authorization code interception attacks even on public clients (SPAs, mobile apps).
Refresh Token Rotation
Every refresh token use issues a new refresh token and invalidates the old one. Refresh token reuse is detected and triggers immediate session revocation for the entire family — a stolen refresh token cannot be silently abused. Rotation windows, absolute lifetimes, and grace periods are configurable per application.
Discovery & Standard Endpoints
A fully compliant /.well-known/openid-configuration endpoint lists all supported scopes, grant types, response types, and endpoint URLs per tenant. Standard endpoints: /authorize, /token, /userinfo, /introspect, /revoke, and /logout. Any OIDC-certified library connects without configuration beyond the discovery URL.
