How it works
Your organization and its applications
Section titled “Your organization and its applications”- Your organization is your company in Tenon-Auth. Its Administrators and Helpdesk staff sign in to the console at
admin.glow-kin.com, each with their own second step. - Applications are your systems that sign users in, e.g. a portal and an internal tool. Each has its own API keys (
tnk_…), created in the console. - Users belong to the organization, so all its applications share them. A user has one second-step method, used by every application.
Tenon-Auth knows each user by your own ID for them, the externalId: e.g. your account’s ID, never a password. createUser is idempotent: calling it again with the same ID returns the same user. beginSecondStep calls it for you.
Tenon-Auth keeps only what the second step needs:
- the method and its secret, encrypted;
- recovery codes, as hashes;
- remembered devices;
- sign-in requests and an audit log.
It never sees passwords. deleteUser removes it all when someone leaves.
Methods
Section titled “Methods”A user has one method at a time. Setting up a new one replaces the old one once it is confirmed.
| Method | What the user does | Proves | Notes |
|---|---|---|---|
Sign-in approval (PUSH) |
Approves on their phone in Tenon Authenticator, picking the number your page shows | The phone, with its hardware key, and its PIN or fingerprint | The strongest. Number matching stops approval fatigue |
Authenticator codes (TOTP) |
Types the 6-digit code from any authenticator app | The phone or app holding the secret | Works offline. Codes can be phished, like passwords |
Email codes (EMAIL) |
Types the 6-digit code from an email | Only access to the mailbox | The weakest: for users who can’t use an app. Off until your Administrator allows it, optionally only for your domains |
getMethods tells you which your organization offers.
Challenges
Section titled “Challenges”A challenge is one sign-in’s second step: createChallenge starts it, and beginSecondStep does it for you.
- Sign-in approval: the phone gets a notification, and your page shows the number. The challenge expires after 2 minutes.
- Codes: it expires after 5 minutes, or after 5 wrong codes.
Limits:
- 10 wrong codes in a row lock the method for 15 minutes.
- At most 5 approval requests or emails per user in 15 minutes.
Recovery
Section titled “Recovery”- Recovery codes: 10 one-time codes the user saves when they set up their method. Each one can pass a challenge instead of the phone.
- Access passes: one-time passes your helpdesk issues after checking who is asking, valid for an hour.
- Remembered devices: after a sign-in, a browser can skip the second step for 14 days if the user asked.
See Recovery.
Where your data is
Section titled “Where your data is”| What | Where |
|---|---|
| The API | https://api.glow-kin.com |
| The console | https://admin.glow-kin.com |
| Traffic | Over TLS, through Cloudflare |
| Data | In Tokyo |
| Secrets | Encrypted with a key kept apart from the database |