// authentication & identity · 2024 → 2026
Sign-in that enterprises trust and users don't notice
I led the replacement of a legacy, multi-tenant sign-in system with a new auth framework, rolled out organisation by organisation behind a per-tenant switch. Before that, we hardened the old one: expiring tokens, central signing and key rotation.
Every sign-in, end to end
- sign-in requestfrom a tenant domain
- resolve organisationfrom the host name
- choose a method
- 2FAenforced per org
- rate-limit checkper identity
- session + signed tokenEdDSA · published keys
rate limiting by identity, not just IP
Separate buckets per user, email, token and IP, per organisation, so one noisy office network can't lock out everyone behind it.
zero-downtime key rotation
Verifiers accept old and new keys during an overlap window, so signing keys rotate without logging anyone out.
How it evolved: legacy service → enterprise-grade sign-in
- legacy auth service
- shared auth library
- expiring, rotated tokens
- new auth framework
# in practice
- Enterprise customers sign in through their own identity provider and can require 2FA for everyone.
- Sign-in links in emails still work after Slack or Outlook previews them.
- Tokens expire and keys rotate on a schedule, with no forced logouts.
- Services can verify tokens themselves against published keys, ready for service-to-service auth.