Native / full
Partial, configurable, or add-on
Not supported
| Dimension | EntryIdPthis system | Auth0Okta company | Oktaworkforce / CIC | AWS Cognitouser pools | Microsoft EntraExternal ID |
|---|---|---|---|---|---|
| Authentication proving who you are | |||||
| Primary factor | Face liveness only — no password path exists | Password, social, or passwordless (configurable per app) | Password, social, FIDO2, passwordless | Password or passwordless, per user pool | Password, social, FIDO2 / Windows Hello |
| Biometric liveness detection | Rekognition Face Liveness on every login | Not built in — marketplace partners only | Not built in | Not built in | Device-level only (Windows Hello), not server-verified |
| MFA / step-up | N/A — liveness is the one required factor | TOTP, SMS, push, WebAuthn | TOTP, SMS, push, WebAuthn, Okta Verify | TOTP, SMS only | TOTP, SMS, push, FIDO2 |
| ID document check | Text-presence check only (Rekognition DetectText) | None — marketplace IdV partners only | None built in | None | None — partner integrations only |
| Face-to-document match | Rekognition CompareFaces at registration | None built in | None built in | None | None built in |
| Bureau-grade KYC | Config-driven stub — not production-trustworthy yet | None — requires a third-party vendor | None — requires a third-party vendor | None — requires a third-party vendor | None — requires a third-party vendor |
| Authorization what a token grants, and to whom | |||||
| Supported grants | Auth Code + PKCE, refresh — nothing else | All standard grants, incl. client credentials | All standard grants, incl. client credentials | All standard grants, incl. client credentials | All standard grants, incl. client credentials |
| client_credentials (M2M) | Rejected at the protocol handler — hard constraint | Supported | Supported | Supported | Supported |
| PKCE | Required on every public client, no exceptions | Optional, recommended | Optional, recommended | Optional, recommended | Optional, recommended |
| Consent model | Per (sub, client), one-time — never re-prompts once granted | Per-app consent, configurable skip | Per-app consent, admin can pre-grant | Basic consent screen, limited configurability | Per-app consent, admin consent workflows |
| Tenancy model | One deployment, tenant_id claim + membership table | Organizations (paid add-on) or separate tenants | Separate orgs — no single-IdP multi-tenancy | One user pool per tenant | Separate Azure AD tenants |
| Per-tenant policy config | Liveness threshold + challenge type, per tenant | Yes, within an Organization | Org-level only | Pool-level only | Tenant-level only |
| Tenant admin portal | Full tenant administration — directory, roles, membership, merge/purge, policy (assumes /products TODO complete) | Organization management UI, paid tier | Per-org console, no cross-tenant view | AWS Console only, no tenant concept | Per-tenant Azure portal, no sub-tenant delegation |
| Token signing | RS256 via AWS KMS — no local key material | RS256, Auth0-managed keys | RS256, Okta-managed keys | RS256, AWS-managed keys | RS256, Microsoft-managed keys |
| Access token lifetime | 15 min, fixed | Configurable | Configurable | Configurable | Configurable |
| Refresh rotation + replay detection | Family-based rotation, DynamoDB-tracked | Yes — rotation gated to a paid tier | Yes | Rotates, but no family replay detection | Yes |
| Platform & delivery neither authn nor authz | |||||
| Platform admin console | Built-in SPA, break-glass key or admin-role token | Full dashboard, SaaS | Full admin console, SaaS | AWS Console only — thin user-ops UX | Azure portal |
| End-user self-service portal | Profile, consents, sessions, export, deletion | Universal Login profile page only | End User Dashboard, limited scope | None built in | My Account portal, basic |
| GDPR export / erasure | Self-service, in-product | Via API or support ticket | Via API | Custom build required | Custom build required |
| Observability | Custom EMF metrics + SLO burn alarms + audit log, self-built | Built-in logs, dashboards, Log Streams | System Log + dashboards | CloudWatch only, basic | Azure Monitor + sign-in logs |
| Hosting model | Self-hosted, single-tenant Lambda deployment | Multi-tenant SaaS (private cloud is a paid add-on) | Multi-tenant SaaS | AWS-managed SaaS | Microsoft-managed SaaS |
| Rate limiting | Identity-aware limiter on 4 routes + gateway + WAF | Built in, tier-dependent | Built in | Fixed AWS quotas, not adaptive | Built in |
| Cost model | Flat per-MAU (R5 ≈ $0.31), no monthly base fee | Per-MAU, tiered | Per-user, per month | Per-MAU (AWS pricing) | Per-user, per month (M365-bundled tiers) |
Where EntryIdP diverges
Every platform in this table treats biometrics as an MFA factor bolted onto a credential that still exists underneath. EntryIdP's bet is that liveness replaces the password rather than supplementing it — there is no fallback path, by design.
That shows up structurally: PKCE and single-use auth codes are hard constraints rather than settings, client_credentials is rejected outright rather than offered behind a checkbox, and identity checks run inline at registration instead of through a bolted-on KYC vendor.
The trade is a narrower, self-hosted footprint in exchange for owning the entire signing, session, and admin surface. Billing is one flat per-MAU rate with no monthly base fee, no tier ladder, and no per-factor add-ons.
Where we honestly lose today
- Bureau-grade IdV is a config-driven stub — identity_verified is not production-trustworthy yet.
- MFA menus: if a buyer's requirement is literally "TOTP + push + WebAuthn options," the one-factor design is a mismatch by intent, not a roadmap item.
- Observability is self-built CloudWatch tooling, not a polished vendor dashboard.
- Rate limiting covers 4 routes at the app layer; the rest lean on WAF/API Gateway alone.