Product

No code. Or build it in.

The server connects to Okta with no code at all. The SDK puts the same check anywhere your own product needs to know who is on the other end.

For identity and IT teams

No code

Webhook

Select Ollet under the Identity Provider tab in your Okta Admin Console.

Fire Ollet when

Workforce sign-in for admins, finance and support
Password and MFA resets, before the help desk grants one
Admin console and break-glass access
Release approvals, payment runs, anything irreversible
A new hire’s first login, and a contractor’s re-check

The integration, in full

Okta · Sign-on policy Active

Rule: Privileged actions

If the user is in Admins, Finance, Support
And the action is a password or MFA reset
Then require Ollet

Saved. Policy active. No code.

Turning it on

01
Add Ollet

From the Okta Integration Network, the same way you added everything else.
02
Enable it

Ollet shows up as an authenticator in your admin console, already configured.
03
Point policies at it

Pick the groups, the apps and the actions that have to prove a person.

Standards underneath, not a workaround: OAuth 2.0 and OIDC, with Pushed Authorization Requests so a request never passes through the browser to be tampered with. Your stack does not change shape to hold it.

For product and engineering teams

Custom integration

SDK

Call it at the moment identity matters, wherever that is in your product. You keep the flow and the interface; the read, the match and the proof are ours.

Reads the ID’s NFC chip and validates its government signature
Matches the live face against the portrait inside the chip
Runs entirely on device, including in airplane mode
Returns a signed assertion, never an image

import Ollet

// Wherever your product needs the person, not the session.
let result = try await Ollet.verify(
    reason: "Approve a $40,000 transfer"
)

switch result {
case .verified(let assertion):
    // Signed, and only an assertion: no image or biometric data.
    try await api.approve(transfer, proof: assertion)
case .noMatch, .cancelled:
    api.deny(transfer)
}

import io.ollet.Ollet

when (val r = Ollet.verify(reason = "Approve a \$40,000 transfer")) {
    is Verified  -> api.approve(transfer, proof = r.assertion)
    is NoMatch,
    is Cancelled -> api.deny(transfer)
}

import { verify } from "@ollet/server";

// The proof stands on its own: checked against the issuer's public
// certificate chain. Nothing to call home to, no account state to load.
const proof = await verify(request.body.assertion);

if (proof.valid && proof.freshWithin("60s")) {
    approve(request.body.transferId, proof.subject);
}

Six places teams fire it

Account recovery

The one door every stolen credential walks through. Prove the holder before the reset, not after the takeover.
High-value transfers

A wire, a payout, a withdrawal. Bind the person to the approval at the moment they give it, not to the session they opened that morning.
Marketplace onboarding

The driver, the host, the courier, the contractor. Check that the person who passed onboarding is the person who shows up to the job.
Regulated care

A prescription, a claim, a records request. A name on a session is not a patient, and a photograph is no longer proof of one.
Remote hiring

Right-to-work checks and first-day access for someone you will never stand in a room with, without a notary or a video call.
Agent approvals

An AI agent proposes the irreversible action; a responsible human identity signs for it. Accountability lands on a person, not an API key.

Start with the one that fits.

Most teams switch the server on first, then reach for the SDK once the check has to live inside their own product.

Talk to us

No code. Or build it in.

Webhook

SDK

Account recovery

High-value transfers

Marketplace onboarding

Regulated care

Remote hiring

Agent approvals

Start with the one that fits.