A computer-implemented method, comprising: receiving from a client device, at a first service of a service provider, a request for substitute sensitive data of the service provider, the request including a set of attributes, granting of access to the substitute sensitive data being contingent upon successful multi-factor authentication of the first service, the set of attributes identifying at least: a first entity associated with the client device; and a second entity associated with an interface displayed by the client device; generating, by the first service using a private key of an asymmetric key pair, a digital signature based on the set of attributes, a second service of the service provider lacking access to the private key; providing, to the second service by the first service, proof of credentials associated with the first service and the digital signature; performing, by the second service, the multi-factor authentication of the first service by at least: authenticating the proof of credentials as a first factor of the multi-factor authentication; and authenticating, using a public key of the asymmetric key pair, the digital signature as a second factor of the multi-factor authentication; granting, by the second service to the first service, access to the substitute sensitive data; storing, in a data store, metadata that associates the substitute sensitive data with the first entity and the second entity; and causing, by providing the substitute sensitive data to the client device, the client device to: enter the substitute sensitive data into the interface in place of sensitive data associated with the first entity; and cause, by submission of the substitute sensitive data to the second entity, the second entity to perform an operation using the substitute sensitive data. receiving from a client device, at a first service of a service provider, a request for substitute sensitive data of the service provider, the request including a set of attributes, granting of access to the substitute sensitive data being contingent upon successful multi-factor authentication of the first service, the set of attributes identifying at least: a first entity associated with the client device; and a second entity associated with an interface displayed by the client device; a first entity associated with the client device; and a second entity associated with an interface displayed by the client device; generating, by the first service using a private key of an asymmetric key pair, a digital signature based on the set of attributes, a second service of the service provider lacking access to the private key; providing, to the second service by the first service, proof of credentials associated with the first service and the digital signature; performing, by the second service, the multi-factor authentication of the first service by at least: authenticating the proof of credentials as a first factor of the multi-factor authentication; and authenticating, using a public key of the asymmetric key pair, the digital signature as a second factor of the multi-factor authentication; authenticating the proof of credentials as a first factor of the multi-factor authentication; and authenticating, using a public key of the asymmetric key pair, the digital signature as a second factor of the multi-factor authentication; granting, by the second service to the first service, access to the substitute sensitive data; storing, in a data store, metadata that associates the substitute sensitive data with the first entity and the second entity; and causing, by providing the substitute sensitive data to the client device, the client device to: enter the substitute sensitive data into the interface in place of sensitive data associated with the first entity; and cause, by submission of the substitute sensitive data to the second entity, the second entity to perform an operation using the substitute sensitive data. enter the substitute sensitive data into the interface in place of sensitive data associated with the first entity; and cause, by submission of the substitute sensitive data to the second entity, the second entity to perform an operation using the substitute sensitive data.