Security
Security is at the core of everything we build at AuthKit.
OAuth 2.0 Standard
We implement industry-standard OAuth 2.0 with PKCE and state validation to prevent CSRF attacks.
HTTP-Only Cookies
Session tokens are stored in HTTP-only, secure cookies — never exposed to JavaScript or client-side code.
Secure Infrastructure
Data is stored in Russian Federation with encryption at rest and in transit.
No Token Exposure
Provider tokens are never sent to the browser. All token exchange happens server-side only.
Responsible Disclosure
If you discover a security vulnerability in AuthKit, please report it responsibly to our security team. We take all reports seriously and will respond promptly.