| Specification | What it does | Scope | State |
|---|---|---|---|
| Sign-in service | Sign-up, sign-in, sessions, recovery, organisations and API keys for your users. | Multi-tenant. One service for every application you run. | In development |
| SDKs | Drop-in sign-in components, route guards and session hooks. | Web, mobile and server, starting with Next.js and Rust. | In development |
| Token verifiers | Check a token on your own server with no call to the service. | Rust and Python first. | In development |
| Developer console | Users, sessions, organisations, API keys, branding, email templates, webhooks, logs and analytics. | Per application, each with its own sign-in settings. | In development |
| Authenticator apps | Native two-factor codes and passkeys for your users. | Multiplatform, Android first. | In development |
Unlike Authenticator
Everything an application needs to sign people in: a hosted passkey-first service, SDKs, a developer console and native authenticator apps across platforms, with every token signed by post-quantum cryptography. In development.
Platform
Protocols
| Specification | Current statement | State |
|---|---|---|
| WebAuthn / passkeys | Platform passkeys and FIDO2 hardware keys are the primary credential. | In development |
| OAuth 2.0 with PKCE | Authorization-code flow with PKCE for every client type. | In development |
| OpenID Connect | ID tokens and discovery, so any OIDC client can connect. | In development |
| Social sign-in | Google, Apple, Microsoft, GitHub and the other major identity providers. | In development |
| Enterprise SSO | SAML and OIDC federation with corporate identity providers. | In development |
| Email one-time codes | Address verification and fallback sign-in. | In development |
| Credential fallback | Optional, per application. | In development |
| Signature family | Post-quantum token signing. | In development |
Token life
| Specification | Value | State |
|---|---|---|
| Access token | 60 seconds | Confirmed |
| Session | 24 hours | Confirmed |
| Refresh token | 30 days; rotation behavior is in development. | In development |
| Refresh family cap | 90 days from first issuance. | Confirmed |
| Replay grace | 10 seconds; idempotent retry. | Confirmed |
| Token subject | The user ID inside a token is encrypted with AES-256-GCM. | In development |
| Proof of possession | DPoP (RFC 9449) binds API calls to a key the client holds. | In development |
| Device binding | Sessions are bound to the device that created them. | In development |
Post-quantum
| Specification | What it does | Boundary | State |
|---|---|---|---|
| Token signatures | Every token carries a NIST-standardised post-quantum signature. | Public keys are published for outside verification. | In development |
| Signing root | Verifiers pin the post-quantum signing root by fingerprint. | One publishable key carries the pinned set. | In development |
| Device transfer | Accounts move phone to phone over a post-quantum key exchange. | Nothing passes through a server. | In development |
| Shared vaults | Team-shared entries are protected by post-quantum key encapsulation. | Each member holds their own key. | In development |
Feature gates
- Trusted-contact recovery
- Contacts the user chose approve a recovery by quorum.
- In development
- Cross-device enrollment
- Scan a QR code and confirm a PIN to add a passkey on a new device.
- In development
- Multi-tenant organisation
- Organisations with roles and member management.
- In development
- Scoped API keys
- Programmatic access limited to the scopes granted.
- In development
- Hardware-key support
- FIDO2 security keys, with a dedicated management screen.
- In development
- MFA beyond passkeys
- Authenticator-app codes and email codes as second factors.
- In development
- Directory synchronisation
- SCIM provisioning from corporate directories.
- In development
- Webhooks
- Sign-in, sign-up and recovery events, per application.
- In development
- Admin panel and audit log
- User management, audit history and system health.
- In development
App: accounts and codes
| Specification | What it does | Boundary | State |
|---|---|---|---|
| Code types | Makes time-based (TOTP), counter-based (HOTP) and Steam codes. | Every code is made on your phone from the stored key. No server takes part. | In development |
| Adding an account | Scan its QR code, paste an otpauth link or type the key in by hand. | The camera is used only to read a QR code. A scanned or pasted link is confirmed before it is added. | In development |
| Importing | Reads Google Authenticator's transfer QR codes, Aegis and 2FAS backups (password-protected ones too), Ente's plain-text export, otpauth links and an encrypted export from Unlike Authenticator. | An account the app cannot read is skipped and listed. The rest still import. | In development |
| Exporting | Saves an encrypted file under a password you choose, or plain otpauth links. | Plain links are not encrypted and show every secret key, so the app asks you to confirm first. | In development |
App: custody
| Specification | What it does | Boundary | State |
|---|---|---|---|
| Your phone | Holds the vault and makes every code. | The vault is one encrypted file in the app's private storage. | In development |
| The vault | Encrypted with AES-256-GCM. | A key derived from your password with Argon2id protects the key that opens it. | In development |
| Biometric unlock | Optional. A key in Android's Keystore opens the vault after a biometric check, such as a fingerprint. | The password always still works. If the phone's fingerprints or screen lock change, biometric unlock turns off. | In development |
| Network | The app has no internet permission. | Android does not let it open a network connection. | Confirmed |
| Screen | Screenshots and screen recording are blocked by default. | You can allow them in Settings, after a warning. | In development |
| Clipboard | Copied codes are marked sensitive. | The app clears the clipboard after 45 seconds if the code is still there. If the app is in the background then, it clears when you return. | In development |
| Backups | Excluded from Android and Google cloud backup and from device-to-device transfer. | Your backup is the encrypted export, which you make and keep. | Confirmed |
App: recovery and limits
| Specification | Behavior | Limit | State |
|---|---|---|---|
| Forgotten password | It cannot be reset or recovered. | If you forget it, your accounts cannot be opened. Keep an encrypted export somewhere safe. | In development |
| New phone | Accounts do not move on their own: nothing is backed up or synced. | Import an encrypted export, or add each account again. | In development |
| Adamanture account and sync | Not offered. | The app has no account, cloud or sync, and works without one. | Not offered |
Apps roadmap
- Desktop apps
- The same vault and codes on desktop.
- In development
- Wearables
- Codes on the watch, without taking out the phone.
- In development
- System passkey provider
- The app holds passkeys and offers them to every other app.
- In development
- OTP autofill
- Codes filled into the sign-in form directly.
- In development
- End-to-end encrypted sync
- Every device of yours, with keys only you hold.
- In development
- Backup into Unlike Vault
- Encrypted backups kept in your own Unlike Vault.
- In development
- Offline security checkup
- Flags weak secrets, duplicates and services that offer passkeys.
- In development
- Import from anywhere
- Every major authenticator and password manager with an export.
- In development
- Recovery codes
- Stored with each account, encrypted in the vault.
- In development
Credential roles
| Specification | Unlike Authenticator | Security Key | State |
|---|---|---|---|
| Product category | Sign-in platform, SDKs and authenticator apps — in development | Physical credential — in development | In development |
| Relationship | Accepts FIDO2 hardware keys as passkeys | May act as a credential; physical specification not decided | Research |
Security evidence
Product status
Unlike Authenticator is in development: the sign-in platform, SDKs and apps are not available to use yet.
In development
Network access
The app declares no internet permission, and the build removes it even if a library asks for one.
Confirmed
Data collected
No data is collected. The app has no account, analytics, crash reporting or advertising, and it cannot open a network connection.
Confirmed
Vault encryption
The vault is one file encrypted with AES-256-GCM. A key derived from your password with Argon2id protects the key that opens it.
In development
Biometric unlock
Biometric unlock is optional. Android's Keystore holds the key and Android does the check, so the app never sees biometric data.
In development
Independent review
No independent security audit has been done, and no results are published.
Pending
App privacy policy
Contact
- Questions and support
- support@adamanture.com
- Confirmed
- Developer contact
- dev@adamanture.com
- Confirmed