Dual Authentication

X.509 client certificates combined with JWT/SSO integration for defense-in-depth identity verification.

An X.509 client certificate is validated at the Go headend on every connection; a JWT token authorizes subsequent API calls.
Both factors are verified independently before a client is granted access.
Local username/password authentication with bcrypt hashing, HTTP-only/Secure/SameSite session cookies, and configurable session timeout is always available.
Enterprise adds SAML2, OAuth2, and LDAP/Active Directory SSO with attribute-to-role mapping, plus TOTP/SMS/FIDO2 multi-factor authentication — the local auth baseline is never removed.