Skip to main content
FASTCLINIC SOLUTION · FASTLOGIN

One sign-in for every Fastclinic product.

Verified identity, phishing-resistant MFA, and OAuth2 / OIDC for the whole ecosystem. Sign in once. Use Doorcta, OneHealth, FastCredits, and every partner app — without ever rebuilding auth.

Sign in to Fastclinic
One account for every product
Sign in with passkey
Use password instead
15-min access · 24-hr refresh · rotating tokens
fastlogin.fastclinic.xyz/login
FastLogin is the identity layer of the Fastclinic ecosystem — one verified account, one MFA enrolment, one consent record, every product.

Technical overview

Healthcare apps in Nigeria still ship their own login screens, their own identity checks, their own audit logs. Every duplication is a place users get fatigued, providers go unverified, and regulators get a different story from each system.

FastLogin replaces all of it with a single, NDPA 2023-compliant identity service. Patients verify their phone and email once. Providers verify their MDCN licence and pass a liveness check once. Organisations provision their staff once. From there, every Fastclinic product — and every partner app that integrates the single sign-on — speaks to the same verified identity, the same tamper-evident audit log, and the same scope-limited access token.

Multi-factor enrolment is built in — passkeys, authenticator apps, and backup codes — because no single factor is enough to meet a NIST AAL2 bar. Sessions are carried by short-lived access tokens that rotate automatically, so a token is never a long-lived key, and a revoked session stops working everywhere within moments. Credentials and the audit trail stay within African data residency, and the audit log is exported to write-once storage.

Identity is a system, not a feature. Building it once and reusing it everywhere — one account, one enrolment, one consent record — is the difference between an ecosystem of products and four loosely related apps.

Capabilities

Auth
  • Email + phone verification (OTP)
  • Passkey (WebAuthn / FIDO2)
  • TOTP authenticator app
  • Backup recovery codes (lookup_secret)
  • Password as fallback only
  • Session-bound CSRF on every flow
MFA / step-up
  • Phishing-resistant by default
  • AAL2 step-up before sensitive scopes
  • Per-device session listing + revoke
  • Configurable step-up freshness window
  • Hardware-key support (YubiKey / Titan)
KYC
  • Didit liveness (passive single-frame)
  • iBeta Level 1 PAD certified
  • MDCN licence verification (provider)
  • NIN verification (patient)
  • 3 retry attempts before terminal decline
  • 30-day Didit retention, 24-hour purge
OAuth2 / OIDC
  • 15-min access tokens
  • 24-hour refresh with rotation
  • JWKS · 5-min cache
  • Scope-limited consent screen
  • Authorization-code with PKCE
  • Client-credentials for service tokens
Audit
  • Hash-chained event log
  • 7-year retention
  • Daily export to WORM S3
  • Africa/Lagos timezone
  • After-hours flagging (08:00–18:00)
  • Per-IP and per-device columns
Compliance
  • NDPA 2023 §25 lawful basis
  • African data residency
  • Documented data-processing record
  • DSAR export pipeline
  • Cross-product consent ledger
  • Quarterly third-party pentest

Integrations

Fastclinic
Doorcta

Telehealth signs patients and doctors in via FastLogin. Consult start requires AAL2 within the last fifteen minutes. Doorcta never sees the user's password.

Fastclinic
OneHealth

Health-record access requires AAL2 plus an explicit scope on the consent screen. Provider identity is the MDCN-verified FastLogin identity — there is no separate clinical login.

Fastclinic
FastCredits

The shared credits ledger trusts FastLogin's identity for both individual and organisation accounts. Hold, capture, and refund actions all carry the FastLogin user ID and write to the same audit chain.

External
Ory Kratos

Open-source identity store. We run pinned releases and edit configuration at fastlogin/ory/kratos/. Container restarts are part of every config change.

External
Ory Hydra

Open-source OAuth2 / OIDC server. Tokens are signed with rotating keys; the public key set is cached by every relying party for five minutes. Hydra never sees user passwords.

External
Didit

External KYC processor for liveness, MDCN licence OCR, and NIN verification. Signed agreement under NDPA 2023; selfie data deleted after thirty days on Didit's side.

Compliance & safety

NDPA 2023 — lawful basis recorded

FastLogin processes personal data under contract, consent, legal obligation, and legitimate-interest bases per NDPA 2023 §25. Every dataset and processor is recorded in the data-processing record kept by the Fastclinic Limited data controller (RC 1919428).

NDPA 2023 (NDPC)
Audit log — 7-year hash chain, daily WORM export

Every authentication event is hashed into a Postgres-side chain. Tampering with any historical row breaks the chain. We export the chain daily to write-once-read-many S3 storage; the seven-year retention satisfies records-of-processing requirements.

African data residency

Identities, sessions, KYC artefacts, and audit logs are hosted in a Nigerian-region AWS account. Cross-border transfer is limited to the named Didit liveness flow under signed processor agreement.

Phishing-resistant MFA policy

Every FastLogin account holds both a passkey credential and a TOTP secret. Passkeys carry the phishing-resistance properties NIST 800-63 names as AAL2-eligible without an authenticator-app fallback. We require both factors so a lost device is recoverable.

NIST 800-63B
Token lifetimes — short by design

Access tokens last fifteen minutes. Refresh tokens last twenty-four hours and rotate on every use. JWKS caches expire every five minutes. Compromise windows are measured in minutes, not weeks.

Plain answers

Ready to ship with FastLogin?

Request a 30-minute architecture review. We will walk through the integration points, the compliance posture, and the timeline.