[{"data":1,"prerenderedAt":125},["ShallowReactive",2],{"work-/work/identity-and-onboarding":3,"work-siblings-/work/identity-and-onboarding":99},{"id":4,"title":5,"body":6,"client":78,"confidential":79,"description":70,"extension":80,"featured":81,"meta":82,"navigation":79,"order":83,"path":84,"period":85,"secondary":86,"seo":87,"sitemap":88,"slug":89,"stack":90,"stem":95,"summary":96,"track":97,"__hash__":98},"work/work/identity-and-onboarding.md","Onboarding and identity for a regulated crypto platform",{"type":7,"value":8,"toc":69},"minimark",[9,14,18,22,25,28,32,48,52,62,66],[10,11,13],"h2",{"id":12},"context","Context",[15,16,17],"p",{},"A regulated crypto wealthtech platform bridging DeFi, CeFi and TradFi. Regulated means onboarding is a compliance surface, and identity is the door to custody. I led the team that built the secure onboarding and identity layer. The client is current, so it stays unnamed.",[10,19,21],{"id":20},"the-problem","The problem",[15,23,24],{},"Invitations are tokens that get emailed, forwarded, clicked twice and clicked late. A single-use invitation token has more states than valid and used, and most implementations discover the others in production.",[15,26,27],{},"Authentication had to go through a third-party identity provider using OIDC with PKCE. KYC verification came from a specialist vendor and had to be visible, as one fact, to every core service that makes a decision on it.",[10,29,31],{"id":30},"what-i-did","What I did",[33,34,35,39,42,45],"ul",{},[36,37,38],"li",{},"Specified the invitation token lifecycle as a state machine before writing it, with every state and transition named, so that clicked twice and clicked after expiry had defined outcomes rather than surprising ones.",[36,40,41],{},"Built an auth gateway in front of the core services, with OIDC/PKCE against a third-party identity provider so that credential handling stays with the provider.",[36,43,44],{},"Integrated a KYC verification vendor across the core services, so verification status is written once and read everywhere.",[36,46,47],{},"Ran the invitation flow through an email provider, with delivery treated as one of the token's states.",[10,49,51],{"id":50},"what-it-cost","What it cost",[33,53,54,57,60],{},[36,55,56],{},"A state machine is more design up front than a boolean. It pays for itself the first time a token is forwarded to the wrong inbox.",[36,58,59],{},"Delegated identity means the provider's outage is your outage, and the provider's session model is your session model.",[36,61],{},[10,63,65],{"id":64},"outcome","Outcome",[15,67,68],{},"Production-grade onboarding and identity in a regulated product, delivered by the team I led.",{"title":70,"searchDepth":71,"depth":71,"links":72},"",2,[73,74,75,76,77],{"id":12,"depth":71,"text":13},{"id":20,"depth":71,"text":21},{"id":30,"depth":71,"text":31},{"id":50,"depth":71,"text":51},{"id":64,"depth":71,"text":65},"Anonymised, current engagement",true,"md",false,{},6,"/work/identity-and-onboarding","Current",null,{"title":5,"description":70},{"loc":84},"identity-and-onboarding",[91,92,93,94],"Auth gateway","OIDC/PKCE","Single-use tokens","KYC integration","work/identity-and-onboarding","A single-use invitation token lifecycle specified as a state machine, an auth gateway with OIDC/PKCE, and KYC verification across core services.","engineering","6dqAy0BnIXlOQEENXcuc1vEHsQYbmoLW-NSFNL7J9UA",[100,103,106,109,112,115,116,119,122],{"title":101,"path":102},"Rebuilding a remittance platform, then getting it licensed","/work/remittance-rebuild",{"title":104,"path":105},"What changes between eight engineers and thirty","/work/scaling-to-thirty",{"title":107,"path":108},"Estimating engineering work you then have to deliver","/work/scoping-fixed-price-work",{"title":110,"path":111},"Making a versioned datastore queryable without losing its history","/work/versioned-data-analytics-replica",{"title":113,"path":114},"Making three custody providers interchangeable behind one wallet interface","/work/provider-agnostic-wallet-layer",{"title":5,"path":84},{"title":117,"path":118},"A promotion framework for a consultancy that does not fit product-company ladders","/work/engineering-ladder",{"title":120,"path":121},"Automating end-of-day reconciliation","/work/reconciliation-automation",{"title":123,"path":124},"Reporting to a foreign regulator out of a core banking system","/work/fatca-regulatory-reporting",1789350680299]