IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
CAEP & Shared Signals
Rotation and revocation protect one system. But your identity lives in dozens of apps. Your goal: explain how one alert can end a person's sessions in every app.
- Apps trust a login for hours and do not talk to each other.
- Shared Signals lets a transmitter send signed events to receivers.
- The receiver checks the event, then cancels sessions and tokens.
- It also writes a revocation marker for live access tokens.
The problem: apps do not talk to each other
Your IdP ends a session. But the app you signed in to 20 minutes ago still thinks you are fine. It will not look again for hours. CAEP (Continuous Access Evaluation Profile) changes this. Instead of "trust this login forever", it says "keep checking, and react to events within seconds".
A signed event between trusted systems
The Shared Signals Framework is a standard way for a transmitter to send security events to receivers. A transmitter can be an IdP, a fraud service or an ITDR tool. Each event is a Security Event Token: a signed token that says what happened.
The receiver checks the signature and finds the person. Then it cancels that person's sessions and refresh tokens. It also writes a revocation marker, so even a live access token is refused.
You report a lost debit card to your bank. Seconds later, every ATM and shop terminal declines it. You did not visit each one. Shared Signals is that kind of alert for identity.
What starts a signal
🚪 Session revoked
An admin or user ended a session. Drop it everywhere else too.
🔑 Credential change
A password reset or key change. Old sessions should not survive it.
📉 Assurance change
The sign-in strength dropped. Ask for proof again before anything sensitive.
📱 Device risk
A device failed its health check. Cut its access until it is healthy.
Zara, the security operator, sees Priya's laptop flagged as hacked in the SIEM. Her ITDR tool sends a "session revoked" signal for Priya. Every app drops her sessions within seconds. See when things go wrong and identity logs & SIEM.
Canceling that stops at your own front door is not containment. Shared Signals turns local canceling (rotation, revocation markers) into a kill switch for the whole network.
Go deeper: the standards
A Security Event Token is defined in RFC 8417. The OpenID Foundation approved Shared Signals and CAEP as final specifications in September 2025.
🧪 Interactive lab — enable JavaScript to play with this one.
Check your Shared Signals receiver setup with SSF Check.