Authentication

How Ehfina keeps your connection secure.

How authentication works

When you connect Ehfina to ChatGPT or Claude, the connection is secured using OAuth 2.0 — the same industry-standard protocol used by banks, health services, and major technology platforms.

The authorization flow

  1. Request: Your AI assistant needs to access your Ehfina data. It redirects you to Ehfina's authorization page.
  2. Sign in: You sign in to your Ehfina account (or create one) on the official Ehfina authorization page at auth.ehfina.com.
  3. Grant permission: You review what access the AI assistant is requesting and approve it.
  4. Secure token: Ehfina issues a short-lived access token to your AI assistant. This token is what the assistant uses for future tool calls.

What makes it secure

  • Short-lived tokens: Access tokens expire automatically, limiting exposure if a token is ever compromised.
  • PKCE: Proof Key for Code Exchange prevents authorization code interception attacks.
  • Revocable: You can revoke any connection at any time, and the revocation takes effect immediately.
  • Scoped: Connected assistants can only access the specific data your account permits — they cannot widen their own access.

What the token allows

The access token allows your AI assistant to call specific Ehfina tools (such as viewing your profile or recording an experience). It does not allow:

  • Access to other users' data
  • Administrative actions on your account
  • Access to your Ehfina password
  • Unlimited or unrestricted access to the Ehfina API

Revoking access

You can revoke any connected AI assistant's access at any time. See data controls for instructions. Once revoked, the assistant's next request to Ehfina will be denied.

Back to documentation