I just shipped the first public version of Toqen.app on the App Store.
This project started from a simple frustration: authentication is still built around reusable credentials.
Passwords, session tokens, API keys — they all create the same class of problems:
leaks, replay, and uncontrolled sharing.
What I built
Toqen is an access-first authentication system.
Instead of managing credentials, it grants access per request in real time.
The flow is intentionally simple:
scan QR
→ confirm on device
→ access granted
Behind the scenes, each request is signed by the device and verified on the server.
No reusable secrets.
No credentials to share.
Why this direction
I wanted a model where:
access cannot be reused
access cannot be forwarded
access is tied to a specific device
each request is independently verifiable
This led to a challenge-based flow:
short-lived request
single-use
device signature
server verification
What is already working
iOS app is live on the App Store
QR-based login flow is working end-to-end
device key model is implemented
encrypted local vault is in place
Android version is currently in testing.
Where I see it useful
admin panels
internal tools
approving sensitive actions
controlled access to paid content
Basically, any place where access itself is valuable.
What I am looking for
I am currently looking for:
teams interested in trying this in real products
early integrations
feedback from security and backend engineers
If you are working on something where access control matters, I would like to connect.
Contact:
https://www.toqen.app/about#contacts
Android early access:
https://forms.gle/f9FcbHyHJiajmFWV7
What is next
Android release
deeper integration scenarios
Building continues.
