Reference
Identity glossary
35 terms from multi-tenant identity, defined properly — how each one works, where the standard lives, and the mistake engineers actually make with it.
Tenancy
Multi-tenancy
One running system serving many separate customers, each of whose data must remain invisible to the others.
Tenant isolation
The guarantee that one tenant's data cannot be read or written by a request scoped to another tenant.
Row-level security (RLS)
A database feature that filters which rows a query can see or change according to a policy the database enforces.
Custom login domain
Serving a hosted login page on a hostname the customer owns, such as login.example.com.
Protocols
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
OAuth 2.0
An authorization framework that lets an application obtain limited access to a resource without handling the user's credentials.
PKCE
Proof Key for Code Exchange — binds an authorization code to the client that requested it, so a stolen code is useless.
Authorization code flow
The OAuth 2.0 flow where the browser receives a short-lived code that the application exchanges for tokens from its server.
Hosted login
A sign-in page served by the identity provider, which the application redirects to.
JWKS
A JSON Web Key Set — the public keys an identity provider publishes so anyone can verify its signed tokens.
WebAuthn
The W3C browser API for creating and using public-key credentials such as passkeys and security keys.
Redirect URI
The registered address an authorization server sends the user back to, with the authorization code, after sign-in.
Nonce (OpenID Connect)
A random value a client sends on the authentication request and checks in the ID token, to stop token replay.
Discovery document
The JSON metadata at /.well-known/openid-configuration describing an OpenID provider's endpoints and capabilities.
Tokens and credentials
ID token
A signed JWT from an OpenID Connect provider carrying verifiable claims about the authenticated user.
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
Refresh token
A long-lived credential used to obtain new access tokens without the user re-authenticating.
DPoP
Demonstrating Proof of Possession — binds a token to a key the client holds, so a stolen token alone is useless.
Token exchange
Trading one token for another with different, usually narrower, privileges.
Machine identity
Credentials issued to a service, workload or agent rather than to a person.
Client credentials grant
The OAuth 2.0 grant where a service authenticates as itself, with no user involved.
Bearer token
A token that grants access to whoever presents it, with no proof that the presenter is its intended holder.
Sender-constrained token
An access or refresh token bound to a key the client holds, so it cannot be used by anyone who merely copies it.
Token introspection
An endpoint where a resource server asks the authorization server whether a token is active and what it grants.
Token revocation
A standard endpoint that lets a client tell the authorization server a token is no longer needed and must stop working.
Passkey
A phishing-resistant sign-in credential: a key pair, scoped to one website, created and used through WebAuthn.
Sessions
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Idle timeout and absolute expiry
Two different session limits: one measured from last activity, one from sign-in.
Session fixation
An attack in which the victim is made to sign in with a session identifier the attacker already knows.
Absolute session timeout
The maximum lifetime of a session regardless of activity, after which the user must authenticate again.
Multi-factor authentication (MFA)
Authentication that requires two or more different kinds of evidence — something you know, have, or are.
Back-channel logout
An OpenID Connect mechanism where the provider notifies applications server-to-server that a session has ended.
Enterprise
SAML
An XML-based federation standard, still the default for enterprise single sign-on.
SCIM
System for Cross-domain Identity Management — a standard API for provisioning and de-provisioning users automatically.
Single sign-on (SSO)
Authenticating once with a central provider and gaining access to multiple applications.
How these are written
A definition that only restates the acronym is not worth a page
Every entry answers the question outright in its first two sentences, explains how the thing actually works, cites the RFC or standard where one exists so you can check us rather than trust us, and names the mistake engineers genuinely make with it. That last part is the only section a specification never contains, and it is the reason these pages exist at all.
Where a term touches what Authreads does, one sentence says how — and never describes a capability as available unless /roadmap lists it as Available. Most entries mention Authreads nowhere, which is correct: this is a reference on identity, not a product tour with definitions attached.
Working through a multi-tenant identity design?
Tell us what you're building. We'll give you the honest answer about whether this platform fits it.