Today, we’re introducing Oneway™, a new capability inside Ackaia ID that we’ve been eager to put into people’s hands. Oneway is already available to eligible accounts, and we’re gradually expanding access as we continue to test and refine the experience. Its first job is straightforward: let you sign in without typing your email address or password every time. But what we’re building around it reaches well beyond the sign-in screen.
We think an identity system should do two things particularly well. It should help people prove that they are the rightful holders of their accounts, and it should let them establish specific facts about themselves without repeatedly handing over the sensitive documents behind those facts. Oneway is our attempt to bring those two ideas together, starting with certificate-based authentication and growing into portable, verifiable attestations.
Your certificate is your way in
Oneway uses mutual TLS, or mTLS, a technology that allows two sides of a connection to authenticate each other using digital certificates. When you activate Oneway in Ackaia ID, you can issue a personal client certificate, download it as a password-protected .p12 package, and install it in a supported browser or device.
From then on, signing in can be as simple as choosing Login With Oneway™. Your browser presents the certificate through our dedicated authentication service, Ackaia checks that it is valid and belongs to an account permitted to sign in, and your session is established without asking you to enter your email address or account password during that flow. Certificate authentication starts only when you choose it; ordinary visits to Ackaia ID don’t trigger a certificate request.
There’s an important security boundary here. Ackaia doesn’t retain your private key for later recovery. You control the downloaded credential and where you install it. Certificates have limited validity, and you can revoke one if a device is lost or you no longer trust it. Activating Oneway and issuing a certificate still require your normal account credentials and MFA when enabled. Passwordless sign-in is a more convenient authentication path, not a reason to remove the security controls around your account.
Oneway Basic is free. Plus gives you more control.
We wanted the essential Oneway experience to be available without a subscription. Oneway Basic is free and includes one active certificate at a time, passwordless mTLS sign-in, and the standard controls to replace or revoke your credential. Its standard certificate lifetime is 90 days.
For people who use several devices or want more control over their credentials, Oneway Plus costs USD 1.99 per month. It supports up to five simultaneously active certificates, so you can manage separate credentials for different browsers or devices. Plus also lets you give certificates custom names, choose their expiration periods within our security limits, access more detailed issuance, renewal and revocation history, and use a simpler renewal process.
The distinction matters to us: Plus adds flexibility and management capabilities, not a stronger version of the underlying cryptography. Basic users get the same certificate-based sign-in security. And even with simplified renewal, replacement certificates still need to be downloaded and installed by their owners; we don’t silently distribute private credentials to devices.
A verified fact should not require a new identity check everywhere
Signing in is the part of Oneway that eligible users can experience today. Behind it, we’ve also implemented a second capability that we’re particularly excited about: Oneway Attestations.
Think of a familiar situation. You’ve already provided evidence that you meet an age requirement, or that you hold a particular eligibility status. Later, a different service needs to establish that same fact. The conventional approach is often to ask for the original document again, leaving another copy of sensitive information in another company’s systems.
We believe there’s a better approach. When Ackaia verifies an attribute, Oneway can record an attestation of the specific claim that was established. Proving an age threshold, for instance, is different from disclosing someone’s entire identity document or exact date of birth. An attestation is designed to preserve that distinction: it says what Ackaia verified, rather than inviting every relying service to repeat the original verification process.
The attribute-attestation capability is already implemented within Oneway. What isn’t available yet is the way to take those attestations outside Ackaia ID and present them to an independent verifier. That’s the next part we’re working on.
Coming next: signed documents and public verification
Our next milestone is to let users export an official Oneway Attestation document from their Ackaia ID account. The planned PDF will be digitally signed by Ackaia and identify the verified attributes it covers, together with the information needed to understand their validity. Instead of asking someone to take a screenshot of an account page or trust an easily altered document, we want to give them a verifiable record issued by Ackaia itself.
We’re also building a public verification service at ackaia.com/oneway/verify. Once launched, it will let an independent recipient check whether an Oneway Attestation was genuinely issued by Ackaia, whether the document is authentic, and whether the relevant attestation remains valid or has expired or been revoked. A site, employer or other recipient will be able to make its own decision about accepting the verified claim.
To be clear, neither downloadable attestation PDFs nor the public verification service is available today. We aren’t announcing a launch date for them yet. The underlying attribute-attestation capability is in place, and we’re now working on how to make its results portable and independently verifiable without undermining the privacy protections around the original evidence.
Ackaia will act as the issuer of its own attestations, not as a government identity authority. Our signature will establish that a particular statement came from Ackaia and can be checked against our records. It won’t force a third party to accept that statement or replace whatever additional checks a particular situation legally requires. That distinction is part of building a trust system people can actually understand.
An identity layer we want to keep building
Oneway is an important step in how we see Ackaia ID evolving. Certificates give eligible users another way to authenticate without routinely presenting a password. Attestations will give them a way to carry verified facts beyond our own services, without needing to circulate the underlying documents every time someone asks for proof.
We have a lot more to build, and we’re excited to finally share the direction publicly. For now, Oneway sign-in is rolling out gradually to qualified Ackaia ID accounts, with Basic and Plus available as the feature reaches them. If Oneway is already enabled on your account, you can find it in your Ackaia ID Security settings. Our Oneway sign-in guide explains how to issue, install and manage your first certificate.
Passwordless sign-in is where Oneway starts. The ability to prove what matters, and only what matters, is where we’re taking it next.