Summary
- Identity is PADI's. AWS Cognito and the PADI auth gateway handle sign-in, refresh and sign-out; padi.com is one of several "calling apps". The account pages that collect credentials (sign-in, registration) are a Next.js rebuild in the padi.com codebase, served on the account host; their long-term ownership is Q-15.
- Member data is fetched on the server. Next.js calls PADI platform APIs with either a machine token or the member's own token. Browsers never hold the machine credential or call PADI hosts.
- Personal pages are never cached at the edge. They are sent
private, no-store.
| Identity element | Value |
|---|---|
| Identity provider | AWS Cognito (us-west-2), shared across PADI web properties |
| Default sign-in | Redirect to the account pages; tokens return to padi.com's callback |
| Fallback sign-in | Cognito hosted UI, Authorization Code with PKCE |
| Tokens | ID token 60 minutes; refresh token 30 days |
| Member keys in the token | PADI member number, member type (student, store, instructor, consumer) |
| Session | Secure, httpOnly cookies on .padi.com, 8 hours, plus a script-readable presence marker for the header |
| Single sign-out | A session record per member in a GraphQL session service; cross-device sign-out not yet active |
Sign-in, session and sign-out
Two recommendations are with PADI's identity team: return tokens through an authorisation-code exchange rather than on the callback URL, and use SRP-only authentication on the production app client.
Signing in on PADI Travel
Signing in on PADI Travel itself, for example at checkout, signs the visitor out of padi.com. Both fixes are in PADI Travel's backend:
| Option | Behaviour | Cost |
|---|---|---|
| A | Travel pages also show the visitor as signed in, using the padi.com session | A redirect through Travel's host on the first Travel page and about hourly; padi.com's sign-out must also end Travel's session |
| B (recommended) | Same as www.padi.com today: visitors stay signed in on padi.com however they use Travel; Travel shows "Sign in" until they sign in there, then both sessions coexist | Larger cookies for visitors signed in on both |
Page load
The dashboard streams: each module renders as its data arrives, and a module that fails shows "unknown" or hides without breaking the page.
| Setting | Value |
|---|---|
| Timeouts | 10 s per platform call, 20 s for eCards and photo, 30 s for registration |
| Caches (per server, in memory) | Member data 5 minutes, profile 1 hour, course catalog 6 hours, eCards last good 6 hours |
| Failure behaviour | eCards show "unknown" and reuse the last good list; account menu items fail closed (hidden); a refused machine token is dropped and re-requested |
| Measured first load after sign-in | 13 to 19 s against non-production PADI APIs, which take 5 to 16 s per call |
Platform APIs used
| API | Purpose | Token | Readiness |
|---|---|---|---|
| Token endpoint | Machine token (client credentials) | Client secret | Ready |
| Certifications | Member certifications | Machine | Ready |
| Credentials | Professional credentials | Machine | Ready |
| Profile | Name, date of birth, member number | Machine or member | Ready |
| Certification photo | Member photo; the profile photo review service uses the machine token | Member | Ready |
| Course codes | Course codes, shop affiliation and eLearning status, looked up by email | Machine | Ready |
| Product catalog | Course names and images | Machine | Ready |
| Club subscription | Club status | Member | Ready |
| eCards | Digital certification cards | Member | Ready |
| Logbook | Dive totals and units | Member | Ready |
| Courses (commercetools) | Localised course names by package (3 s limit, cached 6 hours; English names if unavailable) | OAuth client credentials | Ready |
| Digital forms | Student forms | Machine | Ready |
| Auth gateway | Refresh, cross-site jump, sign-out, profile updates | Member | Ready |
The detailed readiness findings (codes API-R1 to API-R3 and G1 to G8) sit in the MyPADI API readiness report shared with PADI's platform team, which owns their remediation. APIs not yet available: pinned certifications, course-to-form links, card designs, renewal dates, dive recency, bookings and badges.
Member data model
Preferences are spread over at least three PADI services (language, units, communication opt-ins), and PADI Travel keeps its own profile and photo. A single source of truth for member preferences is an open question for PADI (Q-16).