Authentication

Sign-in that doesn't fight you

Social, passwordless, MFA, and enterprise SSO from one integration. Same session, same tokens, whichever method they pick.

SOC 2 Type 2: Certification in progress alongside ISO 27001.
Brute-force detection: Suspicious sign-in attempts throttled and flagged automatically.
Password leak protection: Credentials checked against known breach corpora at sign-up.
Session control: Inspect and revoke sessions per user, device, and environment.

Social SSO

Let people use an account they already have

Google, GitHub, Microsoft, Apple, and the rest. You turn them on per environment. Duplicate accounts get linked, not created.

Every major provider

Connect Google, GitHub, Microsoft, Apple, and more from the console, with no provider-specific code in your app.

Per-environment provider configuration
Consistent profile normalization
Test credentials for development

Account linking

Users who sign in with a second provider land on the same account instead of a duplicate.

Deterministic linking by verified email
Multiple identities per user record
No duplicate accounts to reconcile

Enterprise connections

Offer SAML and OIDC connections to customer IT teams without a separate integration.

Okta, Entra ID, JumpCloud, Ping, and generic SAML
Domain-based routing to the right connection
Self-serve setup for customer admins

One integration, many methods

Username and password, social login, SSO, and passwordless all resolve to the same session and token model.

Mix methods per environment
Shared session and token semantics
Switch methods without migrating users

Multi-factor authentication

Stop account takeovers before they start

Layer a second factor onto any sign-in method, with enrollment and recovery flows handled for you.

SMS and email passcodes

One-time codes delivered through your configured messaging and email providers.

Per-environment delivery providers
Rate limiting and replay protection
Localized message templates

Authenticator apps

TOTP enrollment for any authenticator, with QR provisioning built into the hosted flows.

Standards-based TOTP
QR and manual enrollment
Per-user factor management

Hardware keys

WebAuthn security keys for the phishing-resistant tier your enterprise buyers ask about.

FIDO2 and WebAuthn
Multiple keys per user
Enforce per environment or per role

Recovery that holds

Recovery codes and admin-assisted flows so a lost factor is not a lost account.

One-time recovery codes
Admin-assisted reset with audit trail
Session revocation after recovery

Passwordless

Skip the password when you can

Passkeys, magic links, and one-time codes. The password stays as a fallback, not the only door.

Passkeys

WebAuthn passkeys for phishing-resistant sign-in that users never have to remember.

Platform and cross-device passkeys
Fallback methods when unsupported
Per-environment enforcement

Magic links

Single-use sign-in links delivered through your own email provider and domain.

Single-use, expiring links
Your sending domain
Works for sign-up and sign-in

One-time codes

Short numeric codes for flows where a link is awkward, such as native and TV apps.

Email and SMS delivery
Configurable length and TTL
Attempt throttling

Console and compliance

Change it in the console, not a release

Turn methods on, see what happened, and show an auditor later. No deploy required.

Configuration per environment

Providers, policies, branding, and claims are scoped to each environment, so staging never leaks into production.

Environment-scoped settings
Custom JWT claim mappings
Branding and hosted-page theming

Audit logs

Every authentication event recorded with actor, method, and outcome for security review.

Sign-in, MFA, and recovery events
Queryable history per user
Stream to your SIEM

Sessions and users

Search users, inspect sessions and devices, and revoke access from one place.

User search and profile edits
Session and device visibility
Immediate revocation

Embeddable components

Drop-in screens, or your own

Prebuilt sign-in, profile, and security UI — or the same APIs behind a screen you already designed.

<UserProfile />

Self-service profile, security settings, connected accounts, and session management.

Free trial

Request a free trial

Tell us what you're building and we'll get you set up with a trial, plus someone who can answer questions as you evaluate.

Full access to the platform while you evaluate it
Help wiring it into your stack from someone who knows it
Answers on SSO, SCIM, residency, and compliance requirements

Connect

Install one SDK or point your app at the hosted sign-in pages.

Configure

Enable the methods, providers, and factors you want per environment.

Ship

Go live with sessions, tokens, and audit logs at the edge.

Want to try it?

Open the console. Turn on a provider. See a session land.

Start Building