Aeion Auth Architecture
A hybrid JWT + refresh-token session model, Redis-backed OAuth state, and background risk-scoring and audit logging — the full request shape from "user clicks Sign in with Google" to a live, revocable session.
What's Included
Authentication methods
OAuth/OIDC (10 built-in providers), SAML 2.0, TOTP + WebAuthn MFA, magic links, API keys
Session model
Short-lived signed access tokens plus a revocable, Redis-backed refresh session — instant server-side logout without sacrificing stateless verification on the hot path
Audit & risk
Every login is recorded with device and geolocation context; suspicious activity is automatically flagged
Enforcement
Roles and permissions are checked at the same data layer as every other module — not just the UI
How It's Built
Each identity capability is isolated and composes through the platform's shared service layer — not a monolith, not a bolt-on.
End-to-End OAuth Flow
What happens between "click Sign in with Google" and "session issued" — every step is a real, auditable part of the request path.
Session Architecture
Hybrid JWT + opaque refresh. The split lets you verify access tokens at the edge without a database round-trip, while still supporting instant server-side revocation.
RBAC Enforcement Layer
Roles and permissions aren't just checked in the UI — they're enforced at the database query layer, for every collection, on every request, whether it comes from the REST API, the admin UI, or an AI agent action.
Frequently Asked Questions
Each pure model gives up something you need. Stateless JWTs verify fast at the edge with no database round-trip, but you can't revoke one before it expires. Server sessions revoke instantly but hit a store on every request. The hybrid split keeps both: a short-lived (15-minute) signed access token carries the hot path with no lookup, while an opaque, Redis-backed refresh session is the revocable source of truth. Logout, password reset, a suspicious login, or an admin-forced logout kills the refresh session immediately, and the access token is gone within its 15-minute ceiling.
No. OAuth access/refresh tokens and TOTP secrets are encrypted at rest before they touch the database, and each data class derives its own independent key. A leaked OAuth-token store can't be used to decrypt MFA secrets or anything else. Magic-link and password-reset tokens aren't stored at all — only a one-way hash is, so the raw token exists only in the email link.
Yes. Platform authenticators (Touch ID, Face ID, Windows Hello) go straight through the browser's native WebAuthn API. External FIDO2 keys — YubiKey, SoloKeys, Titan — enroll and authenticate over USB-HID through the Aeion Bridge hardware layer. Both paths verify FIDO2 assertions the same way on the server.
It's enforced at the database query layer, not the UI. Every collection declares its own read/create/update/delete rules, and they run before any query executes — for the REST API, the admin UI, and AI agent actions alike. A request that doesn't pass gets a clean empty result rather than an error that would reveal whether the data exists, so a misconfigured frontend route or a malicious agent can't reach data it isn't authorized to see.
The architecture is built to support those controls — RBAC at the query layer, an append-only audit log, encryption at rest with per-class keys, RFC-standard auth — but software itself isn't certified; a specific deployment is. The compliance mapping and the Aegis compliance reports show which controls the architecture honors and provide the evidence your auditor needs for your deployment. See the Security page for the full framework mapping.
Auth is $0 — included free with every module, in the same database and under the same audit log as everything else. There's no separate per-MAU meter and no black-box third-party billing surface.