A multi-application authentication service and the admin console that manages it. One identity
provider serves every Skaii application, with per-application isolation, a two-tier security model
(user JWT and service API key), and a cross-device approval flow.
Originally a hand-built identity stack: magic link, cross-device login, OAuth (Google, Facebook,
Apple), RSA-SHA256 JWT issuance with key rotation, JWKS/OIDC discovery, refresh-token rotation,
token revocation, rate limiting and IP blocking. Identity has since been migrated to self-hosted
Zitadel in phases; the custom code that Zitadel replaces is being decommissioned. The admin console
(Skaii.ApplicationManager.Web) stays for non-identity concerns: applications, users, roles,
subscriptions, blocked IPs, audit history.