Evantra

EVANTRA

Identity

Workspace

Identity documentation

Identity documentation

Rules, usage guidance, and review standards for Evantra Identity integrations.

Developer standards

Build with clarity, security, and explicit responsibility.

Evantra Identity is the authentication layer. Your application remains responsible for authorization, permissions, and business-specific access control.

Rules and regulations

  • Use Evantra Identity only for lawful, authorized access.
  • Applications must register exact redirect URIs and rotate secrets responsibly.
  • Identity does not replace application-level authorization. Each application owns its own role checks.
  • Do not store access tokens or session cookies in unsafe client storage.

Usage guide

  • Register a client, add redirect URIs, and request the scopes you actually need.
  • Use the authorization code flow with PKCE for browser-based integrations.
  • Call token, refresh, revoke, and userinfo endpoints from the backend side of your application.
  • Keep your logout and session validation flows aligned with the httpOnly Evantra session cookie.

Strengths

  • Centralized identity for Evantra and partner applications.
  • Session-aware OAuth flow with secure cookie-backed browser state.
  • Clear separation between identity, authorization, and application roles.
  • Admin-controlled client onboarding for production safety.

Importance

  • Protects users with a consistent login and consent experience.
  • Reduces duplicated authentication logic across applications.
  • Improves auditability for sign-in, consent, and client onboarding.
  • Creates a stable foundation for first-party and approved third-party apps.

Review channel

Feature requests, integration concerns, and security suggestions can be submitted for Evantra workers to review.

Submit a suggestion

Terms and regulations

Review the identity terms before integrating or onboarding applications into production.

Read terms

Protected by Evantra Identity

Switch to Workspace