One access layer
Give people a consistent sign-in path across approved applications instead of creating a separate identity island for every product.
Secure access. Less friction.
One secure sign-in.
Your key to the internet.
Accessing the apps that matter should feel simple, not scattered. 1App brings secure sign-in, MFA and organisation-aware access together for connected applications—starting with Alphareon and built to grow into a standalone identity platform.
Standards-first architecture
Bounded sessions
MFA foundation
Organisation-aware
Identity + application context
Session assurance
Idle + absolute limits
1App
Protected access
Welcome back
Continue securely to your organisation and approved applications.
Use your 1App accountSecure sign-in
identity assurance
SSOOne access layer
MFATOTP foundation
OIDCOpen standard
One gateway. Clear boundaries.
OIDC + PKCE
Canonical identity
Organisation context
Revocable sessions
One trusted way in
Less sign-in friction. More time for what matters.
With a shared sign-in experience, people can reach the connected applications they are approved to use without juggling separate account systems. Access is based on verified identity and explicit organisation membership—not guesses about email addresses.
One gateway. More possibilities.
See how secure sign-in connects people to approved applications, starting with the Alphareon ecosystem.
AlphareonParent ecosystem
LogiclConnected relying application
CriticlSuite integration direction
Organisation-aware identity
Keep canonical identity, organisation membership and application access explicit rather than inferring identity from mutable email addresses.
Authentication assurance
Apply MFA and bounded session policy at the identity layer, with stronger limits available for privileged access.
Standards-first integration
Build around OIDC, OAuth and mature identity infrastructure so applications can integrate without proprietary cookie sharing.
Clear application boundaries
1App answers who the actor is and what identity-level access they have. The relying product keeps ownership of its operational work.
Built to go further
Prove the connected-access model with Alphareon and Logicl first, then extend 1App as its own identity product when integrations and public availability are ready.
1
Authenticate
Central 1App identity service
assured
Central 1App identity service
↓
2
Resolve context
Identity, organisation, application
explicit
Identity, organisation, application
↓
3
Continue to product
Standards-based relying application
bounded
Standards-based relying application
✓
Centralise identity, not every application.
1App is built to be an identity gateway. It does not need to own each product's business data, workflow or UI.
✓
Keep identities stable as details change.
Canonical 1App identity is deliberately separate from email so account identity does not depend on a mutable contact field.
✓
Make access revocable.
Organisation and application context are designed to be revalidated rather than copied into indefinite browser sessions.
Trust is part of the product
Security boundaries you can explain.
1App is early, so the public promise stays narrower than the architecture. We describe what is implemented, and keep future capability clearly labelled as future.
Full authenticationCurrent foundation: password + TOTP
Standard session30 min idle · 12 hr absolute
Privileged session15 min idle · 8 hr absolute
Absolute expiryFresh full authentication required
Browser clientNo offline access
Future directionPasskeys / broader federation
Secure access without pretending every risk is the same.
Identity security gets weaker when convenience shortcuts quietly become permanent access. 1App's current foundation keeps application sessions bounded, separates normal and privileged policy, and requires fresh authentication again when the absolute limit is reached.
Server-enforced application session limits.
OIDC Authorization Code flow with PKCE, state and nonce.
Explicit issuer and relying-application boundaries.
No claim that 1App itself is OpenID, ISO, SOC 2 or IRAP certified before it actually is.
For product and platform teams
Let product teams focus on their products.
1App starts with the Alphareon suite, giving connected products a consistent identity boundary. The same standards-first foundation is designed for a wider standalone identity product when broader access is launched.
identity { protocol: "OIDC" flow: "Authorization Code + PKCE" identity_key: "canonical 1App ID" } context { organisation: explicit membership application: explicit access assurance: bounded session policy }
Reuse the standards. Differentiate the experience.
The current identity engine is Keycloak. 1App layers a stable product contract around it rather than exposing raw provider internals as the downstream identity model.
Logicl is the first real relying application, proving the migration pattern while preserving Logicl's existing application-session and tenant boundaries during the first stage.
OIDCOAuth 2.0PKCEKeycloak foundationOrganisation contextMFA
Be part of what comes next
Imagine less time managing sign-ins.
1App is already serving approved Alphareon applications, with broader standalone availability ahead. Public self-registration and commercial subscriptions are not open yet. Tell us how you would use a simpler, more secure way to access connected applications.
Tell us where your current sign-in or access model creates friction.
Register interest in 1App's future standalone product and research conversations.
No account is created from this form and no commercial commitment is implied.
Questions
What 1App is — and is not.
Can anyone create a 1App account?
Not yet. 1App is operational for approved Alphareon applications while we build toward a wider standalone product. Public self-registration and commercial subscriptions have not launched.
Will 1App work beyond Alphareon?
That is the product direction. Alphareon is the first operational ecosystem; broader organisation and application onboarding will be introduced through a separately reviewed launch, not promised as available today.
Is 1App just another password manager?
No. The current product direction is identity and access infrastructure: authentication, MFA, sessions, organisation membership, application access and standards-based SSO.
Is 1App the business-approval or compliance engine?
No. 1App owns identity-plane access. In the Alphareon architecture, governed business-action policy belongs to Sentinel rather than being mixed into authentication.
Does 1App replace each application's own data model?
No. A relying application can keep its own application session, tenant data and operational permissions while using 1App as the authentication and identity authority.
What authentication methods will be supported?
TOTP is the initial MFA method in the current foundation. Passkeys/WebAuthn and broader federation are future directions and are not represented as launched features.