Runtime access

Registered clients

Web origins are checked directly. Android and iOS production apps use short-lived tokens issued by your trusted backend after login or platform attestation.