When we announced that Qeet ID was generally available, the headline was the front door: sign-up, sessions, MFA, the things a developer touches in the first hour. This is a note about the parts underneath — the platform features that decide whether a team is still happy with their auth provider a year later.
Authentication, beyond the password. Email and password sign-in ships with stateful, revocable sessions and refresh-token rotation. Passwordless is first-class too: magic links and one-time codes over email and phone. Multi-factor is TOTP with single-use recovery codes, so a lost device is an inconvenience, not a lockout.
Authorization that stays coherent. Multi-tenant role-based access control sits behind a single permission-check API. Every product and every tenant resolves policy the same way, against the same identity graph — which is the only way access control stays correct as the surface grows.
Machine-to-machine, built in. API keys and service accounts authenticate over the OAuth 2.0 client-credentials grant. Backend services and scheduled jobs get first-class identities, not shared secrets passed around in environment variables.
Standards, not glue. OpenID Connect is wired the way integrators expect: discovery, JWKS, dynamic client registration, and a userinfo endpoint. Standards-compliant clients connect without bespoke adapters.
Events you can trust. Webhooks are HMAC-signed and persisted before they are sent, so deliveries survive a restart. Failures retry with exponential backoff and land in a dead-letter queue rather than vanishing — all fed by a transactional outbox.
An audit log that can't quietly lie. Every audited action is written to an append-only log whose entries are hash-chained. An independent verifier walks the chain and recomputes each hash, so tampering is detectable rather than assumed away.
There is more on the roadmap — passkeys, social sign-in, SAML, SCIM, and asymmetric token signing among them — and it lands on the same identity graph as it ships. The full list of what's live, and what's next, is on the Qeet ID product page. The product, documentation, and changelog live at id.qeet.in.