Your application receives a signed token and never handles passwords directly.
Login, registration, email verification, password reset, and session management are all handled for you. Your application receives a signed token and never handles passwords directly.
Canopy implements OAuth2 authorization-code with mandatory PKCE (S256). The code challenge protects against authorization-code interception, and your backend completes the token exchange using both the verifier and the client secret.
code_verifier and derive a code_challenge.verifier with your client secret.verifier, compare to the stored challenge, validate the client secret, then issue the token.Access tokens are signed with asymmetric keys (RS256). Verify them locally using the public JWKS endpoint, no round-trip to Canopy needed. Standard claims, standard libraries, designed for high-performance applications.
Register OAuth clients through the Developer Console or API. Configure redirect URIs, manage client credentials, and control authentication flows. Supports multiple OAuth clients per environment.
Once authenticated, identities are scoped to an account, assigned roles within each environment, and evaluated against your permission model. Authentication and authorization stay consistent.
Canopy verifies identity and issues a signed token.
The same identity is scoped, assigned roles, and evaluated against your model.
No mapping layer between systems. No duplication of user models.
Redirect users to Canopy’s hosted login, or drive your own UI through the Direct API. Either path returns a signed JWT, and every identity flows into hierarchical authorization.
Redirect users to Canopy’s hosted login page. We own the UI, password ceremony, MFA, and email verification. Your app just exchanges the code for tokens.
Call the identity-auth API from your own login UI with a publishable key. You build the form; Canopy handles credentials, MFA, and sessions, full control over the experience.
Every authenticated identity (from either path) flows into hierarchical, role-based access. No separate user model, no mapping layer.
Two ways to sign in, one identity and authorization model.