Octet LFA

A location factor for sign-in.

LFA (Location Factor Authentication) adds a check that a password, passkey, or OTP cannot make: whether the user is physically inside the region your policy requires. The user proves presence with the Octet Location app on their phone. The proof is hardware-attested and resistant to spoofing, and no raw coordinates leave the device. Your application receives only a region verdict, delivered over standard OIDC.

For LFA pricing, see pricing.

LFA is built on the Octet SDK. The SDK produces and verifies the proof itself: the on-device pipeline, the hardware attestation, the anti-spoof verdicts, the region model. LFA turns that proof into an authentication factor. It wraps the proof in OIDC, applies your policy, and binds it to one of your users on one enrolled phone.

Starting points

• Evaluating LFA → How a login works
• Integrating now → Prerequisites, then the Quick Start
• Deciding what to enforce → Policies
• Users replacing or losing phones → Device lifecycle
• Looking up an endpoint, parameter, or claim → OIDC Reference

What this documentation covers

• Getting Started. What you need before the first login, and a complete login end to end.
• Concepts. The login flow, policies, the device-to-user binding lifecycle, and what LFA stores and never stores.
• Integration Guides. Direct OIDC integration for any authorization-code stack, and identity brokers such as Okta via signed authorization requests.
• Reference. Endpoints, protocol requirements, parameters, claims, and errors.
• Troubleshooting. Indexed by the error you see.

Flow walkthrough

The product page shows the flows step by step: what the person sees on the phone, and the SDK trace at the same instant.

What LFA does not do

• Not a source of identity. LFA is delivered as an OIDC provider, but it establishes where the user is, not who they are. Through device binding it also establishes possession of the enrolled phone. Your primary IdP or your own login proves who the user is: you tell LFA which of your users is signing in, and LFA never sees a password or a profile. Trust & Privacy lists what is stored.
• Not a tracking service. The phone never uploads coordinates. The proof carries only a region verdict ("in GB") and the cryptographic material to check it.
• Not a heuristic. IP geolocation infers a location from network routing and is often wrong. LFA verifies the location instead. Every proof is rooted in the phone's secure hardware (see device attestation in the SDK docs), and a proof that fails any check is rejected.