GFEDERATED
Multiple Gmail and Google identities, each explicitly selected through a trusted OAuth flow.
Not connected · Separate account consentCPX / CHYPHNX · Identity architecture
Staged system — no live sign-in yet
ONE FRONT DOOR.
INDEPENDENT KEYS.
One protected place to launch your personal, academic and CPX systems. Sign into CPX with a passkey when activated, link supported identities individually, and retain a separate recovery route when any provider fails.
No passwords, university credentials or recovery codes are collected on this page. Links to external accounts are not yet configured.
CURRENT POSTUREPREVIEW / NOT ACTIVE
PLANNED ENDPOINTsso.cpx.agency
SECURITY MODELPASSKEY + RECOVERY
01 / Connected account strategy
THE RIGHT CONNECTION
FOR EACH SYSTEM.
Your dashboard should never merge unrelated accounts because two addresses look alike. Each linked identity has its own issuer, authorization and revocation controls.
MCONDITIONAL
Microsoft
Personal OneDrive and student or work accounts remain separate. School policies and MFA still apply.
Not connected · University approval may applyPVAULT
Proton
Mail, Drive and multiple Proton accounts stay protected by Proton's own authentication and vault autofill.
Not connected · Provider-native loginSDEVICE
Samsung
Device identities and Microsoft-linked Gallery storage keep independent account ownership and recovery.
Not connected · Passkey or vault autofill02 / One trusted launch point
EASY TO USE.
HARD TO TAKE OVER.
When Cloudflare Access is enabled, the account hub will sit behind an explicit allow policy. Your own CPX apps can share an authenticated gateway session. External services continue using their official sign-in, selected identity and unique credentials.
An SSO session never grants automatic access to Gmail contents, school records, OneDrive files or proprietary program administration.
01Unlock
Passkey or approved identity provider.
02Choose
Select an individual, explicitly linked account.
03Launch
Open the approved app or native provider sign-in.
03 / $0 Android-first pilot
NO PAID VM.
NO WORKING PC NEEDED.
Launch CHYPHNX Identity from an Android home screen and keep non-secret account nicknames on the device. The interface can open offline after installation. Google, Proton, Samsung and Microsoft still authenticate directly through their official services.
01PHONE
Installable Android hub
Put the current CPX account workspace on a phone home screen. PWA packaging and offline assets need no background Termux server.
Android PWA source staged02OFFLINE
Local directory
Nickname-only personal, business, school and recovery slots, with search and manual import/export. No provider passwords are requested.
No identity server deployed03NATIVE
Independent password vaults
Choose your preferred Android password manager and use its audited app/extension for provider-native autofill and passkeys.
No vault contents collected04RECOVERY
Second-device continuity
Use separately enrolled backup factors, independent recovery methods and encrypted export backups; do not assume cloned devices preserve MFA.
No backup restore verifiedThe phone-first public preview is not a private SSO service. A production `sso.cpx.agency` backend requires independently reviewed passkey/OIDC authentication and strict access controls. Tailscale and the broken-PC recovery path are optional later upgrades, not a requirement to use this organizer.
04 / Resilient by design
CONTROL THE ACCESS.
KEEP THE EXIT.
Phone + backup key
Primary passkey on your phone, independent hardware credential for emergencies.
Google Drive + Proton Drive
Encrypted, separately verified backup destinations. Not live databases or shared login authorities.
Provider-native fallback
Restore access to school, Google, Proton and admin systems even when CPX Identity is offline.