Authentication
Authentication: proving control, not permission
Authentication answers whether a request is bound to a claimed identity. It does not, by itself, decide what that identity is allowed to do.
Knowledge graph
Authoritative introductions to digital trust. No unverified product claims, no thin keyword pages.
All topicsThis page
Authentication
Last reviewed 2026-08-21
Next
Choose authenticators for the risk, then bind them to authorization and evidence.
Request a consultationWho this is for
Developers, IAM engineers, and security architects designing sign-in and step-up flows.
Problem
Authentication is often treated as a complete trust decision.
What to do next
Choose authenticators for the risk, then bind them to authorization and evidence.
Knowledge topics
LibraryAuthentication
Definition
Authentication is the process of verifying that a subject controls an authenticator associated with an identity — a password, a passkey, a certificate, a SIM-backed factor, or another registered secret or key.
Authentication
Why it matters
Stolen passwords, phished sessions, and SIM-swap takeovers succeed when authentication is weak or when a single factor is treated as universal proof.
Strong authentication reduces account takeover. It does not prove that a later high-risk action was intended by the human.
Authentication
How it works
Typical methods include knowledge (passwords), possession (devices, keys, SIM), inherence (biometrics), and context (risk signals). Modern standards such as FIDO2 / WebAuthn bind possession to a device and origin.
Step-up authentication repeats a stronger check when the action's risk exceeds the session's original assurance.
Authentication
Architecture notes
Separate registration of authenticators from daily sign-in. Prefer phishing-resistant authenticators for privileged and high-value actions.
Telecom-backed authentication can add a possession signal rooted in the subscriber's mobile identity. It is still authentication, not authorization.
Authentication
Limitations
A valid authenticator can be used by malware, a coerced user, or an agent holding delegated credentials.
Authentication logs are not automatically non-repudiable authorization evidence.
Authentication
Where this meets Keyra
Keyra's public site describes calm verification when certainty matters, including carrier-aware and government-facing identity infrastructure. Specific protocol endpoints are published only where developer documentation already exists.
Questions
What people ask first.
Plain answers. No product claims that have not been published elsewhere on Keyra.ie.
Does MFA always mean high assurance?
No. SMS OTP is still phishing- and SIM-swap-exposed. Assurance depends on the authenticator class and the threat model.
Are passkeys a replacement for identity proofing?
No. Passkeys prove control of a registered authenticator. They do not, by themselves, prove legal identity.