Lab · 16 / 16
Identity for millions.
An online shop, a bank app or a streaming service. Customers sign up on their own, from many devices, and expect it to take seconds. Attackers expect the same.
Scenario 1 of 7
The platform at a glance
In plain words A front door for every channel, a guard against bots, one place that knows each customer, and the services that sell things.
The CIAM service is the authorization server for every channel. In front of it, bot and fraud defense. Next to it, profile and consent. Behind it, APIs that trust its tokens.
Scenario 2 of 7
Sign-up with consent
In plain words Ask only what you need now, verify the email, and write down what the customer agreed to.
Short forms convert better: email or passkey first, more details later with progressive profiling. The address is verified with a code. Terms and marketing consent are stored with version and timestamp, separately from each other.
Scenario 3 of 7
Sign-in without friction
In plain words Let customers use what they already have: a passkey on the phone or an account they trust.
Passkeys remove passwords and phishing at the same time. Social login with Apple or Google is quick, but link it to one customer record to avoid duplicates. Mobile apps use OIDC with PKCE through the system browser.
Scenario 4 of 7
Bots, fraud and account takeover
In plain words Thousands of fake visitors try stolen passwords. The guard slows them down without stopping real customers.
Credential stuffing, fake sign-ups and SMS pumping are daily. Defenses: rate limits, bot detection, breached password checks, and risk-based MFA that only appears when something looks wrong, such as a new device or an impossible location.
Scenario 5 of 7
Apps and APIs
In plain words Every app gets a short-lived pass, and a single guard in front of the services checks it.
The CIAM issues access tokens with scopes and audiences per API. The gateway validates them with the published keys (JWKS), so business APIs do not each reinvent token checks. TVs and consoles use the device code flow.
Scenario 6 of 7
Privacy and data
In plain words The customer’s data belongs to the customer: they can see it, change it and ask you to delete it.
Profile and consent are the single source for marketing systems: the CRM receives only what the customer agreed to. GDPR rights such as access, rectification and erasure must reach every copy. Data residency can decide where the tenant runs.
Scenario 7 of 7
Scale and experience
In plain words On Black Friday the door must hold millions of people, and still look like your shop.
Plan for peaks and outages: if login is down, sales are down. Measure sign-up conversion and drop-off per step. Keep the login fully branded on your own domain, and decide early between buying a CIAM platform and building one.