A method comprising: receiving, by a computing device comprising a processor and a memory and from a user of the computing device, a first request to log on to a first application; generating, by the computing device, a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application; storing, by the computing device, the first public-private key pair on a local data store for the computing device; sending, by the computing device and to a server computer, a second request to authorize the first public key, wherein the second request comprises the first public key; generating, by the computing device, a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with the server computer; receiving, by the computing device and from the user, credential information; sending, by the computing device, an authentication request including the credential information, the first public key and the second public key, to the server computer; receiving, by the computing device from the server computer, a server token, wherein the server token is generated based on the second public key; storing, by the computing device, the received server token in a second local data store; sending, by the computing device, a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key; receiving, by the computing device from the server computer, a first application token; and after receiving the first application token, authenticating, by the computing device, the first request to log on to the first application. receiving, by a computing device comprising a processor and a memory and from a user of the computing device, a first request to log on to a first application; generating, by the computing device, a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application; storing, by the computing device, the first public-private key pair on a local data store for the computing device; sending, by the computing device and to a server computer, a second request to authorize the first public key, wherein the second request comprises the first public key; generating, by the computing device, a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with the server computer; receiving, by the computing device and from the user, credential information; sending, by the computing device, an authentication request including the credential information, the first public key and the second public key, to the server computer; receiving, by the computing device from the server computer, a server token, wherein the server token is generated based on the second public key; storing, by the computing device, the received server token in a second local data store; sending, by the computing device, a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key; receiving, by the computing device from the server computer, a first application token; and after receiving the first application token, authenticating, by the computing device, the first request to log on to the first application.