Product
No code. Or SDK.
The server connects to Okta with no code at all. The SDK puts the same check anywhere your own product needs to know who is on the other end.
For identity and IT teams
No codeOllet as IDV
Select Ollet under the Identity Provider tab in your Okta Admin Console.
Where it fires inside your company
- Workforce sign-in for admins, finance and support
- Password and MFA resets, before the help desk grants one
- Admin console and break-glass access
- Release approvals, payment runs, anything irreversible
- Rule
- Privileged actions
- If the user is in Admins, Finance, Support
- And the action is a password or MFA reset
- Then require Ollet
Saved. Policy active. No code.
Standards underneath, not a workaround: OAuth 2.0 and OIDC, with Pushed Authorization Requests so a request never passes through the browser to be tampered with. Your stack does not change shape to hold it.
For product and engineering teams
Custom integrationSDK
Call it at the moment identity matters, wherever that is in your product. You keep the flow and the interface; the read, the match and the proof are ours.
import Ollet
// Wherever your product needs the person, not the session.
let result = try await Ollet.verify(
reason: "Approve a $40,000 transfer"
)
switch result {
case .verified(let assertion):
// Signed, and only an assertion: no image or biometric data.
try await api.approve(transfer, proof: assertion)
case .noMatch, .cancelled:
api.deny(transfer)
}import io.ollet.Ollet
when (val r = Ollet.verify(reason = "Approve a \$40,000 transfer")) {
is Verified -> api.approve(transfer, proof = r.assertion)
is NoMatch,
is Cancelled -> api.deny(transfer)
}import { verify } from "@ollet/server";
// The proof stands on its own: checked against the issuer's public
// certificate chain. Nothing to call home to, no account state to load.
const proof = await verify(request.body.assertion);
if (proof.valid && proof.freshWithin("60s")) {
approve(request.body.transferId, proof.subject);
}Where teams fire it inside their product
Account recovery
The one door every stolen credential walks through. Prove the holder before the reset, not after the takeover.
High-value transfers
A wire, a payout, a withdrawal. Bind the person to the approval at the moment they give it, not to the session they opened that morning.
Marketplace onboarding
The driver, the host, the courier, the contractor. Check that the person who passed onboarding is the person who shows up to the job.
Regulated care
A prescription, a claim, a records request. A name on a session is not a patient, and a photograph is no longer proof of one.
Remote hiring
Right-to-work checks and first-day access for someone you will never stand in a room with, without a notary or a video call.
Agent approvals
An AI agent proposes the irreversible action; a responsible human identity signs for it. Accountability lands on a person, not an API key.
Start with the one that fits.
Most teams switch the server on first, then reach for the SDK once the check has to live inside their own product.