SeID · Statick Enterprise IdentityPlatform Backbone - Ships in every solution

Enterprise identity infrastructure, built for operators

The backbone of every Statick solution. OAuth 2.0 + PKCE, OpenID Connect, RS256/EdDSA JWTs, and real-time SIEM event streaming - all inherited before the first product feature ships.

OAuth 2.0 + PKCEOIDC 1.0JWT RS256 / EdDSAJWKSMulti-TenantSIEM Webhooks

Request access

PKCE Auth Flow

Core capabilities

What SeID brings to your stack

Zero shared secrets · Key rotation native

🔑

Token Lifecycle

Issue, rotate & revoke

Short-lived access tokens and rotating refresh tokens signed with RS256 or EdDSA. Revocation propagates in real time through Redis - no stale tokens.

🌐

JWKS Discovery

Public key auto-resolution

Consuming services fetch current signing keys from /jwks. Key rollover is transparent and zero-downtime with automatic kid rotation.

🏢

Multi-Tenant

Per-tenant client registry

Every tenant gets isolated OAuth2 clients with scoped claims, configurable redirect URIs, and per-tenant consent flow policies.

📋

Session & Audit

Full compliance trail

Every token issuance, refresh, revocation, and login event is logged with actor, IP address, and timestamp - ready for SOC 2 Type II and PCI DSS evidence.

3rd-Party SIEM Integration

Stream every identity event to your SIEM

SeID emits a structured, signed webhook payload for every security-relevant event - ready to ingest into Splunk, Datadog, Elastic SIEM, or QRadar with zero custom parsing.

Splunk

HEC + sourcetype=statick:seid

Datadog

Logs API · service:seid

Elastic SIEM

ECS-mapped event schema

IBM QRadar

DSM custom log source

SOC 2 Type IIPCI DSSISO 27001 readyHIPAA compliant events

Event catalog

auth.login.successauth.login.failureauth.logouttoken.issuedtoken.refreshedtoken.revokedsession.terminatedmfa.challenge.sentmfa.challenge.failedpermission.deniedclient.registeredclient.revokedpassword.changedaccount.locked

Webhook payload

{
  "event": "auth.login.success",
  "timestamp": "2025-11-14T08:23:41.011Z",
  "tenant_id": "brightpath-studio",
  "actor": {
    "user_id": "usr_8f1a2b3c",
    "email": "[email protected]",
    "ip": "198.51.100.42",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
  },
  "session_id": "ses_9d8e7f6g",
  "client_id": "statick_brightpath",
  "scopes": ["openid", "profile", "tenant:read", "tenant:write"],
  "metadata": {
    "mfa_verified": true,
    "risk_score": 0.03
  }
}

Auth flow

How SeID secures your stack

A strict PKCE-enforced OAuth 2.0 flow - no implicit grant, no password grant, no shared secrets between services.

Client initiates

App generates a cryptographic code_challenge (S256) and redirects the user to /oauth/authorize with PKCE parameters.

SeID validates

PKCE parameters, client_id, redirect_uri, and requested scopes are verified against the registered client record.

User authenticates

SeID presents a secure login UI. Credentials are validated against the tenant user store with BCrypt hashing.

Code exchange

The authorization code plus the original code_verifier are exchanged at /oauth/token - proving the initiating client.

JWT delivery

A signed access_token (RS256/EdDSA) and refresh_token are issued. The corresponding JWKS entry is available immediately.

API access

Downstream services verify the JWT signature against /jwks - no shared secrets, no inter-service coupling.

Standards & compliance

OAuth 2.0 + PKCEOpenID Connect 1.0JWT RS256 / EdDSAJWKS Auto-DiscoveryBCrypt HashingRedis Session StoreMulti-Tenant ScopingCORS + CSP Hardened

Ready to integrate?

Connect your first client to SeID

Request access

JWKS endpoint, client management, and audit logs available immediately on activation. No additional infrastructure required.

Why Statick

See where this fits in the whole climb.

The 2-minute story of how it all comes together — one step at a time.

Take the Climb→