Where UniAuth is headed
Transparency is a feature. Here is what we recently shipped, what we are building right now, and what is on the horizon. Priorities can shift based on customer feedback.
Recently Shipped
5ML-DSA-44 session signatures
Every session carries a post-quantum digital signature verified on each request. Forgery-detected sessions are revoked instantly.
Passkey Conditional UI
Autofill-triggered passkey authentication on the login page. Users see their passkey in the browser credential picker without extra clicks.
SCIM org-scoped provisioning
SCIM bearer tokens scoped to individual organizations for tenant-isolated user and group provisioning.
Tamper-proof audit trail
Hash-chained audit events with actor binding. Every admin action logged with integrity verification and 2-year retention.
Bulk user import
Import up to 10,000 users from JSON with dry-run preview, automatic password generation, and group assignment.
In Progress
4Hardware security module (HSM) integration
Store PQC signing keys and the OIDC RS256 private key in a FIPS 140-2 Level 3 HSM. Cloud KMS and on-prem PKCS#11 support.
Passwordless-only organizations
Org-level policy to disable password authentication entirely. Only passkeys, magic links, and federated SSO allowed.
Session recording and replay
Opt-in admin session recording for compliance investigations. Tamper-proof storage with role-based playback access.
OIDC certified conformance
Running the full OpenID Foundation conformance test suite and publishing certified results for all supported profiles.
Planned
5Multi-region data residency
Choose where user data is stored: US, EU, or APAC. Region-locked encryption keys and database replicas per tenant.
Risk-based authentication engine
Machine learning model trained on login patterns to dynamically adjust authentication requirements per session in real time.
Verifiable credentials (W3C VC)
Issue and verify W3C Verifiable Credentials backed by UniAuth identity. Support for JSON-LD and JWT-VC formats.
GraphQL admin API
A GraphQL layer over the admin REST API for more flexible queries, batch mutations, and real-time subscriptions via WebSocket.
Mobile SDKs (iOS and Android)
Native SDKs with biometric-gated token storage, PKCE flows, and deep link callback handling for Swift and Kotlin.
This roadmap reflects our current plans as of April 2026 and is subject to change. Items in the “Planned” column are not commitments. We prioritize based on security impact, customer demand, and engineering capacity. If something here matters to your organization, let us know — it helps us prioritize.