01 / REQUEST
Fresh proof each time
Every product request carries a signed JWT with a short expiry and a unique request ID. Reused IDs are rejected during the replay window.
Identity control plane · security overview
A safer path
between your apps.
Switcher helps connected applications hand a person off without sharing sessions. Each backend proves who it is, Switcher checks the identity link, and the destination verifies the one-time ticket before creating its own session.
Built around short-lived proof, explicit trust, and app-owned sessions.
Security, without the mystique
The useful guardrails
A few small protocol choices make stolen credentials harder to replay and account-linking mistakes harder to hide.
02 / SECRET
Keys stay server-side
HS256 secrets stay in backend environments. With RS256, Switcher stores only the public key; the app keeps the private key.
03 / IDENTITY
Conflicts pause for review
Stable identity anchors take priority. Conflicting contact matches enter an operator queue instead of silently joining accounts.
04 / SENSITIVE
Higher assurance when needed
Tier 3 handoffs require a linked account with step-up verification. The target app still checks the account and creates its own session.
Think like an attacker
Three obvious tricks. Three checks.
A quick threat model: what happens if someone copies a request, changes a claim, or steals a handoff link?
01 / TRYREPLAY
Send the same signed request twice
Could a captured API call be resent to create another handoff?
WHAT SWITCHER CHECKS
Every call needs a fresh jti (one-time request ID). Repeats are rejected for 120 seconds.
02 / TRYTAMPERING
Change the user or claim another app
What if someone edits the signed identity or swaps the service name?
WHAT SWITCHER CHECKS
Changed claims fail signature verification. The issuer and signing key must match a registered service.
03 / TRYSTOLEN LINK
Open a copied handoff link twice
Could a second browser session spend a ticket that was already used?
WHAT SWITCHER CHECKS
Tickets expire after 30 seconds, work for the intended service account, and can be redeemed once.
Small security nerd note
A valid signature can still be the wrong request.
Switcher checks who signed, which key signed it, which user it represents, and whether the request is fresh. A signature alone does not make a handoff trustworthy.
≤115s
maximum product token lifetime
30s
one-time ticket lifetime
120s
request replay guard
The ticket is not a login session.
It only proves that a handoff was authorized. The destination backend must authenticate the exact target account, apply its own permissions, and establish its own session. Keep that boundary in your app.