Customer identity and access management (CIAM) is a ready-made sign-up and login system that a company builds into its own app or website, for its customers. It is also called customer identity, or login as a service. With it, the company's developers do not have to write and secure their own code for passwords, OTPs and password resets.
A login system looks simple, but it is easy to get wrong. It must store passwords safely, as hashes. A hash is a code calculated from the password, which cannot be turned back into the password. The system must also send OTPs, reset forgotten passwords, lock an account after many wrong attempts, and let people log in with an existing Google or Apple account. A CIAM service has already built all of this. The app's developers connect to it through APIs, fixed formats in which their app asks the service to sign a user up, check a login or end a session. The service also provides ready-made login screens in the app's own colours.
Say a start-up in Indore launches an app on which parents book home tutors. In its first year, 2 lakh parents sign up. Each parent types a mobile number, and the CIAM service sends a six-digit code through OTP verification. When the parent types the code, the service creates the account. It gives the app a token, a signed message that proves which parent is logged in. In the week of the launch, a program tries to create 50,000 fake accounts in one hour, to collect the sign-up offer. The service passes these sign-ups to bot management, which recognises that a program, not a person, is filling in the form, and blocks them. When a parent changes the saved bank account for refunds, the app asks the service for an extra check through multi-factor authentication (MFA).
CIAM also records consent. India's Digital Personal Data Protection (DPDP) Act requires a company to take a person's clear consent before it uses their personal data for a purpose, except for a few legitimate uses that the Act lists. Under the DPDP Rules 2025, companies must follow this duty from 13 May 2027. The service records what each parent agreed to, and when.
How does CIAM differ from the login that employees use? Single sign-on (SSO) serves a company's own employees: usually a few thousand people, and a few lakh at the largest employers. An IT team creates and removes their accounts. CIAM serves lakhs or crores of strangers who create their own accounts. So it must handle much larger numbers, and it must make sign-up quick. Hospitals use the same kind of service for their patient portal. Banks and lenders often add behavioural biometrics, which checks whether a logged-in user types and swipes like the real customer.