Skip to main content
OpenVPN Access Server × iVALT

Every VPN login, authorized cryptographically by a trusted human.

iVALT adds a 1-click human authorization to every login and digital transaction—helping prevent stolen credentials, unauthorized access, and identity impersonation.

Get started — 90 days freeWatch the setup video
Featured in the official OpenVPN Access Server documentation

What is iVALT?

Before access is granted, the real, verified user approves the request on their registered phone with Face ID or fingerprint. iVALT then checks the device, location and time rules your admin sets, so stolen credentials alone never get anyone in.

Why iVALT

A stolen credential is useless.

Verified human authorization

Every VPN connection is approved by the real user on their registered phone with Face ID or fingerprint.

PKI-backed identity

Identity is bound to the user's registered device with cryptographic keys, so a stolen password alone can't open the VPN.

Time windows

Enterprise

Allow access only during set hours per user, for example 8 AM to 4 PM in their time zone.

Geofencing

Enterprise

Block logins from outside approved locations, even when the username and password are correct.

Works with your current login

Adds a human authorization step after your existing local, PAM, LDAP or RADIUS login. No migration, no new identity store. 1-click and much stronger than 2FA digits.

Stops identity impersonation

Approval is tied to the user's biometric and registered device, so stolen credentials alone cannot provide access.

How it works

Approve access authority in real-time. 1-click ensures the right human.

  1. 01User connects and passes the normal Access Server login.
  2. 02Access Server calls iVALT over a secure HTTPS API.
  3. 03iVALT sends an authorization request to the user's registered phone.
  4. 04User approves with Face ID or fingerprint within 60 seconds.
  5. 05 · OptionaliVALT checks the geofence and time window.
  6. 06Access Server grants or denies the connection.
Setup

Live in three steps.

You need an installed Access Server and root (SSH) console access. Free for 90 days.

STEP 1

Register users in the iVALT app

  1. Download the iVALT app on Android or iOS.
  2. Register with the same email used for the VPN account, and set up biometrics.
Get it on Google PlayDownload on the App Store
STEP 2

Get your iVALT API key

  1. Open the iVALT Developer Portal.
  2. Enter the phone number registered in your iVALT app and select Continue.
  3. Approve the sign-in on your phone with 1 click.
  4. Copy your API key from the portal. It's free and valid for 90 days.
Open the Developer Portal
STEP 3

Connect iVALT to Access Server

1. Clone the integration script
git clone https://github.com/iVALT-Inc/openvpn-ivalt-2fa.git
2. Add your API key in openvpn-ivalt-2fa/main.py
IVALT_SECRET_KEY = "<your_ivalt_secret_key>"
3. Load the script and restart Access Server
sacli --key "auth.module.post_auth_script" --value_file="/root/openvpn-ivalt-2fa/main.py" ConfigPut
sacli start
4. Test with one enrolled user and one who hasn't enrolled yet.

Turn off Access Server's built-in TOTP MFA first. Running both at once causes login failures.

Full guide and video: OpenVPN's official iVALT integration guide · Source: GitHub

Questions, answered

How do I get the API key for the integration?

First download the iVALT app and register. Then sign in to the iVALT Developer Portal with the phone number registered in the app, approve the sign-in on your phone, and copy your API key. Add it to main.py as shown in Step 3.

How much does the API key cost?

The API key is free for 90 days.

How long is the API key valid for?

Each API key is valid for 90 days.

Where do I configure the geofence and time restrictions?

Geofence and time restrictions are available for enterprise customers and are set per user in the iVALT Admin Panel. Contact our team to enable them.

Can I remove iVALT later?

Yes. Run sacli --key "auth.module.post_auth_script" ConfigDel then sacli start. Your original Access Server login keeps working.

Put a trusted human behind every VPN login.

90 days free for OpenVPN Access Server customers.

Get startedTalk to our team

OpenVPN and Access Server are trademarks of OpenVPN Inc.