Authentication
AUTH is the security fortress of the Labs ecosystem — every application, every action passes through this gateway. There is no way to access any part of the system without authentication.
What is AUTH?
AUTH is the security fortress of the Labs platform — a centralized authentication system built on Keycloak, one of the most trusted and widely-deployed identity and access management solutions in the world.
While AUTH itself doesn’t provide user-facing functionality, it’s the mandatory security checkpoint for all interactions within the system. Every application — including User Profile and Organization Profile — must pass through AUTH to ensure secure access. No one enters the system without going through this fortress.
Security — Enterprise Grade
Our security standards meet the requirements of major financial institutions. Your data is protected at the highest level.
Why Keycloak?
Keycloak is an enterprise-grade open-source identity and access management solution that provides:
| Feature | Description |
|---|---|
| Open Source | Fully auditable code, no hidden backdoors |
| Self-Hosted | Complete control over your authentication infrastructure |
| Battle-Tested | Used by millions of users in enterprises worldwide |
| Enterprise Security | Proven in financial, healthcare, and government sectors |
| SSO & Standards | OAuth 2.0, OpenID Connect, SAML 2.0 out of the box |
| Flexible User Management | Granular control over users, groups, and roles |
| Identity Federation | Support for connecting external providers (currently Google is activated) |
| Directory Integration | Native Active Directory and LDAP support |
| Compliance Ready | Meets GDPR, SOC2, and other regulatory requirements |
How We Protect Your Data
Data Storage
All data stays on our servers
- Credentials are stored exclusively on our own servers
- We do not upload passwords to any third-party cloud services
- No external parties have access to your authentication data
- Complete data sovereignty — your information never leaves our infrastructure
Unlike many services that rely on third-party authentication providers, we maintain full control over all user credentials.
Audit Bus — Complete Transparency
On top of Keycloak, we run our own logging bus that provides an additional layer of security and complete audit transparency.
Our custom Audit Bus captures and logs every request to the authorization service:
| Data Captured | Details |
|---|---|
| Who | User identifier, session ID |
| When | Precise timestamp of every action |
| Where | IP address, device type, browser, geolocation |
| What | Action type and result |
What We Log
Login Attempts
All login attempts are logged — both successful and failed. This helps detect brute-force attacks and unauthorized access attempts.
Profile Changes
Any modification to user profile, email, phone number, or security settings is recorded with full context.
Password Operations
Password resets, changes, and recovery attempts are tracked for security analysis.
Session Activity
Session creation, renewal, and termination events are logged for complete visibility.
Double Security
This architecture provides dual-layer protection:
- Keycloak — Enterprise-grade identity management with built-in security features
- Audit Bus — Our custom logging layer for complete transparency and forensic capabilities
This combination ensures that even if an incident occurs, we have complete audit trails for investigation and compliance.
Available Authentication Methods
AUTH supports multiple ways to register and log in. Choose the method that works best for you:
Passwordless is now the default! When you open the login or registration page, you’ll see the Email + OTP form by default. This method is more secure and convenient — no password to remember! You can switch to traditional password-based authentication by clicking “Sign in with password” or “Register with password”.
Supported methods:
- Email + OTP — passwordless login (default)
- Email + Password — traditional method
- Google — social authentication
Detailed instructions for each method:
Key Security Features
Two-Factor Authentication (2FA)
Add an extra layer of security with TOTP-based 2FA. Compatible with Google Authenticator, Authy, and other authenticator apps.
Email Verification
All accounts require email verification to prevent unauthorized access and ensure account recovery options.
Session Management
View and manage all active sessions. Remotely log out from any device if needed.
Brute Force Protection
Automatic rate limiting and account lockout after multiple failed login attempts.
Email Verification
Email verification is an important step to ensure the security of your account and access to all system features.
Why It’s Needed
Email verification is necessary for several reasons:
- Account security — confirmation that you own the specified email address
- Access recovery — ability to reset your password or recover your account via email
- Important notifications — receiving system messages, security alerts, and updates
- Full access — some system features are only available to users with verified email
Important: Accounts with unverified email may have limited functionality. We recommend verifying your email immediately after registration.
When Verification Is Required
Email verification is needed in the following cases:
- After registration via email — when creating a new account using an email address
- When changing email in profile — when you update your email address in profile settings
How to Verify Email
Check your inbox
After registration or changing your email, check your mailbox. The verification email should arrive within a few minutes.
Tip: If the email doesn’t appear in your inbox, be sure to check your “Spam” or “Junk” folder.
Find the email from the system
Look for an email with the subject “Email Address Verification” or similar. The email is sent from the system’s official address.
Click the verification link
Open the email and click the verification button or link. The link will automatically open in your browser.
Important: The verification link is valid for 24 hours. After this time expires, you will need to request a new email.
Confirm successful verification
After clicking the link, you will see a page confirming successful email verification. You can now use all system features.
How to Resend the Email
If the email didn’t arrive or the verification link expired:
Log into your account
Open AUTH and log into your account using any available method.
Go to profile settings
Open profile settings in the account management section.
Find email status
In the email information section, you will see a notification that the address is not verified.
Click “Resend email”
Click the button to resend the verification email. A new email will be sent to your address.
Note: At least 1 minute must pass between email resend requests. This is protection against abuse.
Troubleshooting
The verification email didn’t arrive. What should I do?
If you didn’t receive the verification email:
- Check your “Spam” folder — emails sometimes end up there automatically
- Verify the email address is correct — check that you entered the correct address during registration
- Wait a few minutes — email delivery sometimes takes time
- Request the email again — use the resend function in profile settings
- Check your email filters — make sure your email provider isn’t blocking emails from our system
If the problem persists after all these steps, contact support.
The verification link doesn’t work or has expired
Verification links are valid for 24 hours after being sent. If the link has expired or doesn’t work:
- Log into your account
- Go to profile settings
- Request a new verification email
- Use the new link within 24 hours
Tip: Don’t use old emails — always request a new one if the link doesn’t work.
The email went to spam. How can I fix this?
If verification emails consistently go to your “Spam” folder:
- Mark the email as “Not spam” — this will help your email provider in the future
- Add the sender to contacts — save the sender’s address in your address book
- Create a filter rule — set up automatic delivery of emails from our system to your inbox
These actions will help ensure all future emails from the system arrive in your main inbox.
I entered the wrong email during registration. How can I change it?
If you made a mistake when entering your email address:
- Log into your account using any available method (if you used other registration methods)
- Go to profile settings
- Update your email address to the correct one
- Verify the new email address by following the instructions above
If you cannot log into your account due to an incorrect email, contact support for assistance.
Do I need to verify my email when logging in via Google?
If you registered or are logging in through a Google account, email verification happens automatically. Google has already verified your email address, so additional verification is not required.
Frequently Asked Questions
Is my password visible to your administrators?
No. Passwords are hashed using one-way cryptographic functions. Even our system administrators cannot see or recover your actual password. If you forget it, you must create a new one through the password reset process.
Do you share my data with third parties?
No. Your authentication data is stored exclusively on our servers and is never shared with or sold to third parties. We do not use external cloud services for credential storage.
What happens if I lose access to my 2FA device?
Use your backup recovery codes to log in, then reconfigure 2FA on a new device. For detailed instructions, see Two-Factor Authentication — Lost Device.
Can I use AUTH on multiple devices?
Yes. You can be logged in on multiple devices simultaneously. Each session is tracked independently, and you can manage all active sessions from your security settings.