When Tenon-Auth can't be reached
If your application let people in with the password alone whenever Tenon-Auth didn’t answer, an attacker would only need to make it unreachable, or block your server’s connection to it. So fail closed: refuse the sign-in.
What the SDKs tell you
Section titled “What the SDKs tell you”| Error | Meaning | Do |
|---|---|---|
TenonAuthUnavailable with UNREACHABLE |
No connection: DNS, refused, TLS, or Cloudflare couldn’t reach Tenon-Auth | Refuse (“Sign-in is unavailable, please try again in a few minutes”), log, alert |
TenonAuthUnavailable with TIMEOUT |
No answer in time | The same |
TenonAuthUnavailable with SERVER_ERROR |
Tenon-Auth failed | The same |
ApiKeyRejected |
Your key is wrong or was revoked | A configuration error: never a reason to let anyone in. Alert your team |
EmailUnavailable at sign-in |
Tenon-Auth works, but the email couldn’t be sent | Not an outage: offer the recovery page for challengeId |
The SDKs never resend a call that may have reached Tenon-Auth (a code check counts attempts), so a refusal is final for that call.
Emergency accounts
Section titled “Emergency accounts”To keep a few critical people working during an outage, allow a short list of named accounts to sign in with the password alone, only on TenonAuthUnavailable:
- log every such sign-in, with the IP address, at warning level;
- alert someone about each one;
- keep the list in your configuration, not your database, and review it.
Never let ApiKeyRejected or any other error take this path.
Several addresses
Section titled “Several addresses”The SDKs accept several base URLs, for mirrors of the same Tenon-Auth. With one address (https://api.glow-kin.com, behind Cloudflare), you don’t need more.