Auto Secure Login
Platform-wide identity rollout

Auto Secure Login expands shared identity beyond Pillow Pair to Kavanah Journal

A verified platform update on shared OpenID Connect, Google sign-in, passkeys, Kavanah Journal, exact callbacks, role boundaries and a twelve-point rollout checklist.

Published · 5 minute read

What changed

Auto Secure Login has expanded the shared account-security program from its first Pillow Pair pilot into a platform-wide implementation plan. Kavanah Journal is now live as the second validated OpenID Connect client, with an exact product callback, PKCE, basic identity scopes and a sign-in choice that remains separate from the Journal’s Google Photos and Drive authorization. The protected Command Center also gains a twelve-point readiness checklist covering every portfolio application, public-access decisions, recovery, roles, devices, legal review and operational ownership. Production registration, beta.14 deployment, health verification and public authorization initiation are complete; a real-user sign-in and account-linking test remains an explicit gate.

01

The rollout now covers the full Auto Secure Login software portfolio

The shared identity service was designed for more than one product. Pillow Pair proved the first end-to-end OpenID Connect path, but the same broker must support different application types without forcing every public tool behind a login screen. The current portfolio includes public information services, private consumer applications, staff operations systems, APIs, workers, progressive web apps and an Android Command Center companion. The new rollout manifest classifies each application by audience, surface, current status, identity provider and product-specific terms page so future account work starts from one reviewable source of truth.

Public tools such as Aya, Policy Lens, SOMB and DORA Guidance, HomelessHelper, Doctor and NPI Search and the main bilingual website remain public by design. Outside Access, ASL Direct, Repo Runner and Sentinel are queued because each needs its own authorization and recovery review. StubSafe and APMSG remain behind service-stability gates. Command Center and ASL Tunnel keep their established staff multi-factor protection. This sequence prevents central login from becoming a blanket change that reduces access, harms search visibility or hides unresolved application work.

Delivered in this update

  • Portfolio-wide manifest covering domains, audiences, terms and rollout state
  • Public-interest and SEO pages stay available without an account
  • Queued applications retain product-specific authorization gates
  • Pillow Pair is the first pilot, not the limit of the identity program
02

Kavanah Journal becomes the second shared OpenID Connect client

Kavanah Journal now has an optional Continue with Auto Secure Login provider in its Auth.js sign-in experience. The application requests only openid, email and profile from the shared broker, uses the authorization-code flow with PKCE and state checks, and returns through one exact callback on the Journal domain. Issuer, client identifier and client secret must be supplied together from protected server configuration. If the shared provider is not configured, the interface does not advertise a button that cannot work. English and Spanish labels explain the choices without exposing implementation details.

The Journal also has a separate direct Google authorization path for Photos and Drive. Those broader Google service permissions do not belong in a portfolio-wide identity token, so the two paths stay visibly and technically distinct. Auto Secure Login establishes the account identity; direct Google authorization grants the Journal access to user-selected Google services. Shared-broker access and refresh tokens are cleared rather than copied into the browser session. This separation reduces credential exposure and prevents another product from inheriting Google storage permissions simply because it uses the same central sign-in service.

Delivered in this update

  • Exact Journal callback with PKCE and state protection
  • Shared scopes limited to openid, email and profile
  • Direct Google Photos and Drive authorization remains separate
  • ASL access and refresh tokens are not exposed to browser code
03

Twelve implementation decisions make security status easier to verify

The Command Center now has a twelve-point implementation checklist based on the questions required for a responsible identity rollout. It records the multi-repository architecture, platform types, domains and client identifiers, runtime and session boundaries, recovery methods, user classes, jurisdiction review, authentication versus identity proofing, step-up actions, device policy, accessibility and support operations, and identity-provider capabilities. Each item has a plain status such as active, documented, in progress or review needed. That language is more useful than a single green badge that could conceal unfinished work.

The checklist also states important limits. Central sign-in confirms control of an account; it does not claim government-grade identity proofing, professional eligibility or biometric identification. Passkeys may use a device?s local face, fingerprint or PIN unlock, but Auto Secure Login does not receive or store the biometric template. Sensitive exports, payment changes, messages, role changes and destructive actions still need product-level step-up rules. Colorado-specific products still need retention, age, consent, accessibility and sector review before unrestricted account registration.

Delivered in this update

  • Twelve visible architecture, recovery, role and operations decisions
  • Authentication is not presented as legal identity proofing
  • No central storage of facial or fingerprint templates
  • Product-level step-up and legal reviews remain explicit gates
04

Validation protects the release path before the production switch

The Journal change passed strict TypeScript validation, source resolution, migration ordering, a secret scan, 71 application tests, 16 private-cloud tests and an optimized Next.js production compile. Its dependency tree was also updated after a new image-processing advisory appeared: Next.js moved to the current compatible patch and now uses the application?s patched Sharp release instead of installing the vulnerable optional copy. Existing lint warnings remain documented and non-blocking; no lint errors were introduced. These checks test the code and package, but they do not substitute for a production database build or live account acceptance.

Production registration created the Journal client without printing its secret, loaded it through a root-readable environment and preserved the existing embedded database before beta.14 was built on the Droplet. The live health endpoint reports the new version with its database connected. Auth.js now initiates authorization at the central broker using client kavanah-journal, the exact Journal callback, only openid email profile and an S256 PKCE challenge. A real person must still complete shared or Google sign-in, confirm the intended account-link behavior and exercise recovery before the pilot is considered ready for broad use. The refreshed Command Center also exposed one unrelated Droplet alert: a Repo Runner logrotate rule duplicated Nginx’s standard wildcard. The redundant file was backed up, the full rotation configuration passed validation, logrotate completed successfully, and the Droplet returned to healthy with no failed services.

Delivered in this update

  • 87 automated application and private-cloud tests passed
  • Live beta.14 health, database connection and shared redirect verified
  • Command Center now reports 12 readiness items and healthy Droplet resources
  • Live account linking and recovery remain human acceptance tests

This development note describes verified work and public product direction. It does not disclose credentials, private customer information or protected implementation details.