Docs home
Choose the right path
Top-level sections now have their own routes, breadcrumbs, and sidebar placement so product pages can link to the exact destination.
Getting Started
Create a tenant, register an application, provision clients, validate a token, and make the first protected call with tenant context.
Application Lifecycle
Governed publishers, immutable application revisions, environments, administrator consent, organization installation, human assignment, runtime admission, and removal for qualified profiles.
Guides
Task-based integration guides, including device-bound token issuance and continuous access evaluation.
API Reference
Public API route families, rendered from the identity-server OpenAPI specification.
API Examples
Concrete request and response examples for common authentication and authorization flows.
SDKs
The .NET Nexin.SharedAuth SDK: focused packages (core/OIDC, context, permissions, authorization, service clients, contracts) plus runnable samples for interactive web, machine-to-machine, and device activation.
Device Trust
Device-as-principal trust: activation, approval, offline leases, posture, device-bound and sender-constrained tokens, and CAE.
Enterprise Setup
Enterprise OIDC sign-in and SCIM provisioning, with guidance for Okta, Microsoft Entra ID, Google Workspace, and generic OIDC.
Troubleshooting
Common integration errors and how to resolve them.
Changelog
Notable platform and documentation changes.
Account Email Help
Recognize authentic NexinID account email, safely complete verification, recovery, and invitation actions, and recover from delayed, expired, or unexpected messages.
Help & Support
How to get rollout, security-review, and provider-specific help.
FAQ
Frequently asked questions about NexinID.
Trust Center
Security, reliability, and production-readiness posture, the evidence inventory, and the compliance posture (CRA / PSTI / NIST 8259A / CISA SbD — aligned-to, not certified).
Privacy Architecture
Data classes and per-category retention, data minimisation, aggregate-analytics suppression, and tenant-visible data-subject export and erasure.
Security & Disclosure
Vulnerability disclosure policy and security contact (RFC 9116 security.txt).
Service Status
Current availability posture and how incidents are communicated.
No matching documentation routes
Try searching for API, device trust, enterprise, pricing, security, or FAQ.
Current status
Implemented surface and public boundaries
Public docs distinguish generally available, delivered, Preview, and Roadmap capabilities. “Delivered” does not silently become protocol conformance, certification, or universal production readiness.
| Area | Status | Public boundary |
|---|---|---|
| Authorization Code + PKCE | GA | Default interactive client path. |
| Governed application lifecycle | Delivered | Qualified profiles cover publisher review, revisions/environments, consent, installation, assignment, admission, and removal; production/conformance remain separate. |
| Organization branding | Preview | Versioned text, color, safe-link, preview, publish and rollback on the shared NexinID host; no custom authentication-domain claim. |
| Progressive authentication | Preview | Passkey-first sign-in with policy-governed TOTP fallback and separate recovery. |
| OAuth Device Authorization | GA when enabled | Requires an enabled endpoint and a provisioned device-flow client. |
| Device activation and offline leases | GA (bounded) | Seat-bound activation, approval, heartbeat, renew, transfer, revoke, and audit diagnostics. |
| IoT zero-touch bootstrap | Roadmap | No current FDO, BRSKI, or generic manufacturer zero-touch support claim. |
Security and trust
Diligence material that stays public-safe
The docs summarize the implemented platform without linking readers to private engineering notes. Use them for deployment posture, key handling, tenant isolation, audit visibility, and production-readiness expectations.
Logical tenant isolation inside one deployed instance.
Durable signing and data-protection material for production deployments.
Audit coverage across identity, tenancy, applications, authorization, licensing, device trust, and platform operations.
Dedicated tenant deployments, region pinning, and customer-managed key commitments remain guided commercial review unless contracted.
Authoring model
Docs remain in Razor Pages for now because the site already ships that stack and the current content is componentized around shared partials. New deep-dive content can slot into route-level pages or extracted partials; a markdown docs stack is worth revisiting only when non-engineering authors need regular direct edits.