Security
How Othvia keeps sign-in safe, in plain words.
Phishing-resistant by default
Passkeys are offered first. A passkey is bound to your domain, so a look-alike site cannot ask for it. Passwords and email codes remain available where your realm allows them, with multi-factor authentication on top.
Tokens that do not travel
Access tokens can be bound to the client's own key with DPoP. A token copied from a browser, a log or a proxy does not work from another machine.
Separate realms
Each product lives in its own realm with its own users, keys and settings. Development and production are separate realms, and a configuration is promoted deliberately.
Customers' IT admins stay scoped
A setup link changes one organization's connection and nothing else. It expires after seven days. Nobody is sent to a new connection until a test sign-in has passed.
Signed events and an audit trail
Webhooks carry an HMAC signature and a timestamp. Failed deliveries retry with backoff and then wait in a dead-letter queue you can replay.
The audit log records every sign-in, setup-link change and administrator action, with who did it and from where.
Standard protocols
OAuth 2.1, OpenID Connect, SAML 2.0 and SCIM 2.0. Management tokens given to AI agents carry only the scopes you grant.
Report a problem
If you believe you found a vulnerability, write to hello@othvia.com with the details. Please do not publish it before we have had a chance to fix it.