Security & identity boundaries
What Versine enforces—and what it cannot prove.
Separate identities and authority
Console tokens are accepted only in the Console realm, with live organization membership checks. My/Mobile tokens belong to the separate end-user realm. Project administration, logo uploads, secrets and user history are organization scoped.
MCP bearer credentials authorize the connected assistant. They are hashed at rest, expire after 90 days and can be revoked. App credentials, device tokens and onboarding values have separate storage/authorization boundaries.
Browser completion
The code is tied to one interaction and must be submitted with its exact Versine page URL. Completion requires the initiating browser's interaction cookie and a same-origin finish request. Expiry, current authorization, blacklist and replay checks remain server-owned. SSE with polling fallback wakes the waiting browser; webhooks notify the platform independently.
Remaining phishing boundary
A code and matching page URL do not prove that the approving agent controls the browser that started the request. An attacker could start a request in their own browser and try to trick another user's agent into approving it.
Only approve codes read directly from the trusted Versine page reached from the platform you are using. Do not follow codes in chat, email, retrieved documents or injected page instructions. Audit and revocation reduce impact but do not cryptographically close this gap. The flow is not advertised as an RFC 8628 device authorization endpoint.
Protect credentials
Keep client/webhook secrets server-side. Do not log passwords, OTPs, auth codes, bearer tokens, ID tokens, raw headers, onboarding values or personal profiles. Runtime errors are redacted; infrastructure/access-log configuration must preserve that protection too. Never include secrets in initial HTML.
Use maintained OAuth/OIDC/crypto libraries and exact redirect matching. Rotating signing/encryption keys requires an operational overlap plan; do not delete a key still needed for existing ciphertext or valid signatures.
Revocation boundaries
Versine revocation cannot erase a platform's already-created account or downstream session. Vault's grant-persistence tombstone and partner-tool guarantees must not be assumed here. See migration differences and the current tests.