Onboarding and identity for a regulated crypto platform

Context

A regulated crypto wealthtech platform bridging DeFi, CeFi and TradFi. Regulated means onboarding is a compliance surface, and identity is the door to custody. I led the team that built the secure onboarding and identity layer. The client is current, so it stays unnamed.

The problem

Invitations are tokens that get emailed, forwarded, clicked twice and clicked late. A single-use invitation token has more states than valid and used, and most implementations discover the others in production.

Authentication had to go through a third-party identity provider using OIDC with PKCE. KYC verification came from a specialist vendor and had to be visible, as one fact, to every core service that makes a decision on it.

What I did

• Specified the invitation token lifecycle as a state machine before writing it, with every state and transition named, so that clicked twice and clicked after expiry had defined outcomes rather than surprising ones.
• Built an auth gateway in front of the core services, with OIDC/PKCE against a third-party identity provider so that credential handling stays with the provider.
• Integrated a KYC verification vendor across the core services, so verification status is written once and read everywhere.
• Ran the invitation flow through an email provider, with delivery treated as one of the token's states.

What it cost

• A state machine is more design up front than a boolean. It pays for itself the first time a token is forwarded to the wrong inbox.
• Delegated identity means the provider's outage is your outage, and the provider's session model is your session model.

Outcome

Production-grade onboarding and identity in a regulated product, delivered by the team I led.