UPAS Client Portal

To do

Next steps

4 pending

Complete these items in order. Your progress appears in the cards above.

Profile completion

Complete all four sections

Add your application, organization, contact, and address details.

Required field. Save each section as you complete it.

0 of 4 complete

Client profileApplication detailsWhat users see when your application asks for access.Not saved

Application logo

PNG, JPEG, or WebP up to 2 MB. A square 512 × 512 image is recommended.

Application display name Application typeThis helps us apply the right security requirements. Application homepagePublic HTTPS address where users can learn about your application, for example https://example.com. Application descriptionExplain what the application does and how it uses UPAS. Minimum 30 characters. 0/500

OrganizationOrganization & contactLegal identity, business address, and responsible integration contacts.Not saved

Organization contacts

People UPAS can contact about administration, security, and integration matters.

Legal organization name Administrator emailReceives account and review updates. Security contact emailReceives security and credential alerts. PhoneBegin with the international country code; spacing is applied automatically. Extension

Business address

Search for the address or complete the fields manually.

Search addressType at least three characters, then choose a result to fill the address fields. Street address Unit/Suite CountryBegin typing a country name or two-letter code, then choose from the list. City Province / state / region Postal / ZIP codeEnter the postal code used for this business address. PO Box

Trust & legalApplication policiesPolicies users can review before granting access.Not saved

Privacy policy URLPublic HTTPS page that opens without signing in, for example https://example.com/privacy. Terms of service URLPublic HTTPS page that opens without signing in, for example https://example.com/terms.

User supportSupport contactsContact details users see when they need help.Not saved

Provide at least one support method

Support emailMonitored address for user questions and account-support requests. Support websitePublic HTTPS help centre or contact page, for example https://support.example.com.

Feature setup

Choose at least one feature

Choose what your application needs.

Use QR Login for sign-in. Add Account Sync if users need to share profile information.

0 of 2 enabledNo capabilities configured

Available features

Enable capabilities

Select one

QR LoginOffLet users sign in by approving a QR code in the UPAS app.No password · Approval from a trusted device

Account SyncOffReceive profile information a user chooses to share and keep it up to date.Requires QR Login · User-approved data

Account Sync requires QR Login

QR Login works on its own and does not share profile data. Account Sync starts only after the user signs in and agrees to share information.

QR Login setup

Complete QR Login setup

Choose how your application receives sign-in results.

Choose at least one delivery method and review the session settings.

1 of 2 sections readyConfiguration not saved

How QR Login worksUPAS creates secure sign-in information for your application to display as a QR code.Learn more

1Created
2Waiting
3Scanned
4Checked
5Approved
6Signed in

The session can also be: Denied, expired, cancelled, or invalid.

UPAS creates the QR information

UPAS creates and signs the session information. Your application displays it as a QR code without changing it.

The UPAS app checks the code

The signed-in user scans the code. UPAS checks it before showing the approval request.

The user approves sign-in

Your application receives the result after the user approves or denies the request.

Account Sync can follow

QR Login does not return profile data. If Account Sync is enabled, your application can retrieve only the information the user approved.

QR Login settingsDelivery and session settingsNeeds setup

Result delivery

Supported methods

Select every method your application supports. Polling is the simplest option and works as a fallback.

PollingCheck for the sign-in result every few seconds. Long pollingReduce repeated requests by holding one until state changes or it expires. Server-sent eventsReceive results through a one-way live connection. HTTP/2 streamReceive many results efficiently over one connection. WebSocketReceive results immediately over a two-way connection.

Session settings

Timing and limits

The defaults work for most applications. Each preferred delivery method keeps its own settings.

Preferred methodChoose one of the methods selected on the left. Use polling as a fallback if live updates stop. Polling intervalHow often your application checks for a result. Session expiryHow long the session information encoded in the displayed QR remains valid. Two minutes is recommended for most sign-in flows. Retry timingControls how quickly your application retries after a connection is lost. Gradually slower is recommended. Pending session limitThe maximum number of sign-in requests that can wait at the same time.

Account Sync setup

Complete Account Sync setup

Choose what users can share and where updates should be sent.

Select at least one profile field and add an update URL.

0 of 3 requirements completeConfiguration not saved

First sign-in and updates

How Account Sync works

Requires QR Login

First sign-in

Connect the user’s account

1
Receive a temporary setup token
After the user approves QR Login, your application receives a short-lived token. No profile information is included.
2
Get the approved profile
Use the token to retrieve the current information the user approved.
3
Create an account reference
Store the profile, create a reference for the local account, and return that reference to UPAS.
4
Use the reference later
Future sign-ins return the same reference so your application can find the correct local account.

Profile updates

Receive an update notice

When a user changes shared information, UPAS tells your server to retrieve the latest approved profile.

Update noticeSigned HTTPS message

Message contentsReference and version

Get profileAuthenticated request

ResultCurrent approved profile

Update URLUPAS sends a notice to this URL when shared profile information changes. The notice does not contain profile data.

Technical update detailsSecurity checks, versions, retries, and replacing stored dataLearn more

Check the UPAS signature before processing the notice.
The notice includes an event ID, time, account reference, and profile version—but no profile fields.
Use an authenticated request to retrieve all currently approved profile fields.
Replace the stored UPAS profile data and save the new version together.
Remove fields the user no longer shares.
Return a successful response after accepting the notice. UPAS retries unsuccessful deliveries.

If notices arrive twice or out of order, use the newest profile version.

Credential setup

Complete client setup

Choose how your application connects securely to UPAS.

Finish the required setup before requesting credentials.

Not ready

Environment

Choose test or production

Sandbox and production credentials are separate. A credential works in only one environment.

Sandbox environment

Client credentials

Not issued

Your application uses these credentials to identify itself to UPAS.

Client IDSafe to include in requests

Available when issued

Public-key authenticationPrivate key stays with your application

Public key not registered

Keep the private key secure. Never place it in browser code, a mobile app, source control, or logs.

Application security

How your application signs in

Choose how your application securely identifies itself to UPAS.

Recommended protection

Signed JWTRegister a public key. Your application signs each request with its private key.RecommendedMutual TLSRegister a certificate that your application presents when it connects.Strong protectionClient secretUse a secret stored by your application and UPAS. This is simpler but offers less protection if exposed.Basic

Public key sourceRegister only public verification material with UPAS. Keep the private key in your secure environment.JWKS URLUse a stable HTTPS endpoint that publishes the active and next public keys for safe rotation.

Advanced restrictionsBrowser and network boundariesOptional origin and outbound-IP controlsConfigure

Use these as additional restrictions. They do not replace cryptographic client authentication.

This application calls a UPAS endpoint directly from browser JavaScriptLeave this off when the browser communicates only with your application server.

Allowed outbound IPs OptionalEnter one fixed egress IP address or CIDR range per line. This is a supplemental network restriction, not proof of client identity.

Security boundariesHow these credentials are usedClient authentication, QR signing, notifications, and device keysLearn more

Client authentication: your application uses the configured method when it creates QR Login sessions, retrieves authorization results, or fetches Account Sync snapshots.
QR trust: UPAS creates and signs the login-session information. The client does not sign or alter it; it only renders the signed information as a QR code.
Update notifications: verify the UPAS notification signature with the published UPAS verification key. Application authentication credentials are not notification-signing keys.
User-device identity: the user-specific device key pair is separate from the application’s client-authentication keys or secrets.
Environment isolation: sandbox credentials cannot access production, and production credentials must never be used in test systems.

Test readiness

Prepare to test

Test each enabled feature before submitting your registration.

Finish setup and create sandbox credentials before running tests.

Not ready0 of 3 requirements completeCredentials not issued

QR Login

Test a sign-in

Not configured

Run a complete QR sign-in. No profile information is returned in this test.

1
Create sign-in requestReceive the session details from UPAS.
2
Display QR codeShow the signed information without changing it.
3
Scan with the UPAS appThe signed-in user scans the code.
4
Approve sign-inThe user reviews and approves the request.
5
Receive the resultYour application creates its own user session.

Set up QR Login before running this test.

Last resultNot run

Duration—

Test ID—

Account Sync · First sign-in

Create a user profile

Not configured

Use a new sandbox user who has not signed in to this application before.

1
Receive setup tokenThe sign-in result contains a short-lived token.
2
Get approved profileYour application retrieves the information the user approved.
3
Create account referenceYour application stores the profile and creates a local reference.
4
Connect the accountsUPAS saves the reference for future sign-ins.

Set up Account Sync and create sandbox credentials first.

Last resultNot run

Duration—

Test ID—

Account Sync · Profile update

Receive updated information

Not configured

Use a sandbox user already connected to this application, then change the user’s profile.

1
Update the profileChange approved information in the UPAS app.
2
Receive an update noticeThe signed notice contains a reference and version, but no profile data.
3
Check the signatureReject notices that do not have a valid UPAS signature.
4
Refresh the stored profileRetrieve and save the latest approved information.

Complete the first sign-in test before testing profile updates.

Last resultNot run

Duration—

Test ID—

Sandbox activity

Recent test results

0 runs

No tests run yet

Completed tests will appear here with their time, duration, scenario, and test ID.

Test coverageWhat these tests confirmSign-in, account linking, profile updates, and sandbox safetyLearn more

UPAS returns a short-lived result that your application uses to start its own user session.
QR Login alone shares no profile information. Account Sync shares only the fields the user approves.
Profile update notices tell your application when to retrieve the user’s current approved information.
Tests use separate sandbox credentials and test accounts. They never access live data.

Plan status

No active plan

Manage your plan, usage, billing details, and invoices.

Plan and billing information is not available yet.

No planPlan unavailableNo renewal scheduled

Plan features

Plan information unavailable

Cycle unavailable

Plan details are not available yet.

QR Login: Not defined
Account Sync: Not defined
Sandbox access: Not defined
Live access: Not defined

Current billing period

Usage

No active period

Successful QR logins—

Allowance unavailable

Active Account Sync associations—

Allowance unavailable

Usage shown here reflects only the measurements included in your plan. Charges are never inferred from unlisted activity.

Payment

Payment method

Not configured

No payment method

Add a payment method through the secure payment page.

UPAS shows only a masked summary and does not store full card details.

Billing history

Invoices

0 invoices

Invoice	Billing period	Amount	Status	Download

No invoices yet

Invoices will appear after a subscription begins its first billable period.

Subscription management

Plan actions

Billing administrator

Change planReview capability and allowance changes before confirming.

Change billing cycleEffective date and any adjustment will be shown before confirmation.

Cancel renewalReview the end date and capability impact before cancellation.

Reactivate subscriptionAvailable for subscriptions scheduled to end.

Subscription management is currently unavailable.

Registration readiness

Review your registration

Confirm that every required part of your registration is complete before submitting it to UPAS.

Complete the remaining requirements below.

Not ready0 requirements complete

Required setup

Registration checklist

Select any incomplete item to return to that page.

Home

Complete your setup

Next steps

Complete all four sections

Organization contacts

Business address

Choose at least one feature

Enable capabilities

Complete QR Login setup

Supported methods

Timing and limits

Complete Account Sync setup

Profile information

General profile data

Restricted profile data

Explain why you need this information

How Account Sync works

Connect the user’s account

Receive an update notice

Complete client setup

Choose test or production

Client credentials

How your application signs in

Prepare to test

Test a sign-in

Create a user profile

Receive updated information

Recent test results

No active plan

Plan information unavailable

Usage

Billing profile

Payment method

Invoices

Plan actions

Review your registration

Registration checklist