The MFA layer you
run yourself.

A better way to do MFA.

The same job — proving it is really your user, and what they approve — built on the right pillars.

A generalization across the common push- and OTP-based MFA model — no specific vendor implied.

Not an IdP — the layer above it.

Ydentifi is not an identity provider or SSO. It is the multi-factor and action-authorization layer you add to the identity stack you already run — your login, your user directory, your sessions all stay yours. What it changes is how an approval reaches the phone: over a stream the device already holds open, with no Apple or Google push anywhere in the path.

One approval, end to end. Nothing crosses Apple Push or Firebase Cloud Messaging — the challenge rides the stream the device already holds open. (An approval can only arrive while that stream is live.)

Four things, in the box.

Everything you need to run sovereign MFA yourself — and nothing needs external API calls at all. The docs are AI-ready, so your coding assistant can do most of the integration for you.

One ceremony, four moves.

Every authentication and every approval follows the same shape. No personal data changes hands, and nothing leaves your infrastructure.

Because the device signs over the exact details the user sees, a phisher who relays your request cannot change the amount, the destination, or the action — the signature simply will not match. That is what “phishing-resistant” means here, concretely.

Sovereign by design.

Three moving parts, all inside infrastructure you control. There is no Ydentifi cloud in the authentication path.

Your server talks to Ydentifi over gRPC with mutual TLS. Ydentifi streams signed challenges straight to the enrolled device — no Apple or Google push in the path, nothing for a platform vendor to throttle or observe. Everything sits inside infrastructure you own.

Opinions, on purpose.

A few deliberate design choices explain almost everything else about how Ydentifi behaves.

Two signed levels, three separate dimensions.

Match the friction to the stakes — a glance for a login, a signed and located approval for a wire transfer. The server owns the policy, and an approval below the level the action asked for is refused.

TOTP works with a third-party authenticator, but issuing the shared secret through the Ydentifi app sends it over the device’s own connection to your deployment instead of printing it in a scannable code.

TOTP codes

Location-pinned

Action approval

Two ways in — both stay yours.

Ydentifi is unopinionated about your users, sessions, and interface. Adopt as much or as little as you like; nothing about your existing login has to change.

Would rather not spend the engineering time? We can deploy it for you — on your infrastructure, priced to the complexity of the deployment. You keep the keys.

One CLI, the apps, eight SDKs.

Everything is a command — the CLI is the product surface. There is no GUI-only operation and no console you have to sign into.

# bring the server and its database up locally
$ ydfi deploy local up

# provision a relying party — opaque user IDs, no PII
$ ydfi admin create-rp

# sign a relying party’s mTLS certificate from its CSR
$ ydfi admin provision-rp-cert

// your server asks Ydentifi for a challenge — no PII, just your token
ch, err := client.IssueAuthChallenge(ctx, ydentifi.IssueAuthChallengeRequest{
    OpaqueID:    user.OpaqueID,
    Context:     []byte("Approve €4,200 transfer to ···· 8842"),
    MinStrength: ydentifi.AuthStrengthBiometric,
})
if err != nil {
    // handle error
}
// the enrolled device shows the details and signs them;
// the deployment verifies the signature and streams you the outcome
res, err := client.AwaitChallenge(ctx, ch.ChallengeID)
if err != nil {
    // handle error
}
if res.Status != ydentifi.ChallengeStatusApproved {
    deny() // declined, expired or refused
    return
}
// an approval always meets the level you asked for
grant(res.AuthStrength)

Who secures what.

Ydentifi is software you run inside your own boundary, so security is shared: we secure the authentication software and protocol; you secure the infrastructure and keys you run it on. The line is deliberate — it is what keeps you in control and keeps your users’ data yours.

Ydentifi provides the mechanism; you operate the keys and the infrastructure. Your users’ data stays with you — and so do the keys to your deployment.

What it defends against.

The threats that keep a CSO up at night, and the concrete mechanism that answers each.

On passwords & devices.

Passwords aren’t the enemy — how we use them is. You may read our view here → And if you’re weighing passkeys: they fix login, we authorize the action past it — On passkeys →

The design in depth: MFA without Apple or Google push → · Transaction signing and dynamic linking → · Post-quantum MFA →