Link security

Security properties

Account links are short-lived, single-use, integration-scoped, and consent-gated. Partner-signed links are also signed and encrypted. Genesis validates issuer, audience, signature, encryption, time claims, replay ID, and destination before displaying consent.

Sensitive data handling

Treat raw API keys, private signing keys, opaque link IDs, compact JWEs, and unfinished onboarding URLs as secrets. Redact them from logs and support screenshots. Avoid sending unnecessary email or username fields when Genesis can collect them directly.

Passwords

Never put a password in JSON claims or link-generation requests. Your password database and Genesis authentication remain separate. Members either use an existing Genesis credential, authenticate through Genesis OAuth, or choose a new Genesis password.

Incident response

If an API key is exposed, rotate it in the Admin dashboard. If a signing private key is exposed, stop issuing links, ask Genesis to disable signed-link capability or the integration, generate a replacement keypair, and register its public JWK with a new kid.

Include affected time windows and token IDs in an incident report, but never send raw credentials by email.