Explicit user consent
Every verification has its own clear confirmation. No hidden handshakes and no background start.
Security & privacy
Verification without Surveillance.
Technical certainty should not require permanent data exposure. Metric ID keeps verification narrow, consent-driven, and under user control.
Consent-driven identity
Metric ID does not issue a tracking credential until the user understands the request and provides an authenticated, time-stamped consent action.
Read the consent flowAutomatic expiration
Tracking credentials expire with the verification window and cannot become permanent access.
Opening is harmless
Universal links display request information. Opening one never begins location tracking.
Rejection is final
Declining sets the request to rejected, clears tracking credentials, and returns no raw token.
Credential architecture
Secrets are separated, scoped, and hashed.
Browser sessions, user bearer tokens, organization API keys, and verification tracking tokens each have a distinct purpose.
Browser sessions
Signed cookies resume server-side sessions for browser interfaces only.
User bearer tokens
Raw tokens are shown once; only SHA-256 digests are persisted.
Organization keys
Live and test keys use separate environments and the `X-API-KEY` header.
Tracking tokens
Each token is bound to one verification and expires with its tracking window.
Defense in depth
Privacy controls that reinforce each other.
Hashed credentials
Sensitive bearer and tracking tokens are persisted only as one-way SHA-256 digests.
Single-purpose tokens
A tracking token is valid for one verification, preventing cross-request correlation.
Separated authentication
Browser cookies cannot authorize mobile APIs, and organization keys are never user tokens.
Idempotent events
Verification-scoped event identifiers make device retries safe and predictable.
Short-lived links
Portal magic links expire after 15 minutes; invitations expire after seven days and are single-use.
Tenant isolation
Organization portal records are always loaded through the current organization’s scope.
Users can say no
Full rejection and revocation
Declining a pending request prevents tracking from starting. Logout revokes only the bearer token used for that request, preserving control without creating unexpected global side effects.
- Instant permission withdrawal
- Tracking credentials cleared on rejection
Reliable by design
Predictable API boundaries
Stable response envelopes, versioned endpoints, rate-limited authentication, and explicit HTTP status codes make security behavior easier to integrate and audit.
Explore developer controlsBuild trust by design
Make privacy part of the infrastructure.
Build a verification workflow where clear boundaries are a feature, not an afterthought.