Security
Authentication & security
How sign-in works under the hood, including sessions, providers, and the deterministic result screen.
OSTaaS supports password authentication and single sign-on with Microsoft, Google, GitHub, GitLab, and Bitbucket.
Sessions
- Sessions are stored in secure, HTTP-only cookies that browser JavaScript cannot read.
- Passwords are hashed with industry-standard algorithms; they are never stored in plain text.
- Signing out or changing your password invalidates sessions.
Single sign-on
Enterprise providers authenticate you with your organization's identity system using standard OIDC and OAuth flows. Token exchange happens server-side only — no tokens are exposed to the browser.
The deterministic result screen
Every sign-in resolves on one result screen. Success shows a confirmation and redirects you; failure shows a plain-language message, a reference ID, and a troubleshooting link — never a raw provider error or a blank page.
If sign-in fails
See Microsoft sign-in problems or general sign-in troubleshooting. Quote the reference ID when you contact support.
Related
Last updated 2026-09-02