Security

Audit history

Authkits records append-oriented authentication and account-security events with validated, bounded machine-readable metadata. Raw passwords, verification codes, bearer tokens, provider tokens, and license keys do not belong in audit metadata.

Authentication

Successful login, logout, verification, recovery, and MFA activity.

Sessions and devices

Tracked-session creation/revocation and trusted-device security changes.

Credentials and lifecycle

API credential changes, password changes, social connections, and account deletion.

Audit records are part of the core

There is no AUDIT_LOGS=True switch. Security-sensitive Authkits flows write their declared audit events as part of the domain operation. Audit persistence failures are not silently ignored when the event is required for the protected transaction.

Bound metadata

settings.py

AUTHKITS = {
    "AUDIT": {
        "MAX_METADATA_BYTES": 4096,
    },
}

Event metadata uses declared machine-readable schemas. Unknown nested or free-form fields are rejected rather than becoming an accidental place to dump request bodies or secrets.

Examples of recorded security events

Authentication succeeded and email verified

Session created or revoked

Social provider connected or disconnected

API credential created, rotated, or revoked

Password changed or account deleted

Retention is a host policy

Authkits deliberately does not expose a fake automatic retention_days setting. The authkits_prune maintenance command removes eligible transient security state, not append-oriented audit history. Your application decides audit retention, export, and compliance policy.

Next steps

Prepare the host application and Authkits security state for production.

Deployment and operations