Authentication

The easiest way to build user authentication

Ship sign-in that converts and holds up to scrutiny: social SSO, passwordless, MFA, and enterprise connections from a single integration.

SOC 2 Type 2: Certification in progress alongside ISO 27001.
Brute-force detection: Suspicious sign-in attempts throttled and flagged automatically.
Password leak protection: Credentials checked against known breach corpora at sign-up.
Session control: Inspect and revoke sessions per user, device, and environment.

Social SSO

Add high-conversion social sign-in

Let users arrive with an account they already have. Providers are configured per environment, with account linking handled for you.

Every major provider

Connect Google, GitHub, Microsoft, Apple, and more from the console, with no provider-specific code in your app.

Per-environment provider configuration
Consistent profile normalization
Test credentials for development

Account linking

Users who sign in with a second provider land on the same account instead of a duplicate.

Deterministic linking by verified email
Multiple identities per user record
No duplicate accounts to reconcile

Enterprise connections

Offer SAML and OIDC connections to customer IT teams without a separate integration.

Okta, Entra ID, JumpCloud, Ping, and generic SAML
Domain-based routing to the right connection
Self-serve setup for customer admins

One integration, many methods

Username and password, social login, SSO, and passwordless all resolve to the same session and token model.

Mix methods per environment
Shared session and token semantics
Switch methods without migrating users

Multi-factor authentication

Stop account takeovers before they start

Layer a second factor onto any sign-in method, with enrollment and recovery flows handled for you.

SMS and email passcodes

One-time codes delivered through your configured messaging and email providers.

Per-environment delivery providers
Rate limiting and replay protection
Localized message templates

Authenticator apps

TOTP enrollment for any authenticator, with QR provisioning built into the hosted flows.

Standards-based TOTP
QR and manual enrollment
Per-user factor management

Hardware keys

WebAuthn security keys for the phishing-resistant tier your enterprise buyers ask about.

FIDO2 and WebAuthn
Multiple keys per user
Enforce per environment or per role

Recovery that holds

Recovery codes and admin-assisted flows so a lost factor is not a lost account.

One-time recovery codes
Admin-assisted reset with audit trail
Session revocation after recovery

Passwordless

Convert users in seconds, not steps

Remove the password from the critical path with passkeys, magic links, and one-time codes.

Passkeys

WebAuthn passkeys for phishing-resistant sign-in that users never have to remember.

Platform and cross-device passkeys
Fallback methods when unsupported
Per-environment enforcement

Magic links

Single-use sign-in links delivered through your own email provider and domain.

Single-use, expiring links
Your sending domain
Works for sign-up and sign-in

One-time codes

Short numeric codes for flows where a link is awkward, such as native and TV apps.

Email and SMS delivery
Configurable length and TTL
Attempt throttling

Console and compliance

Do more from the dashboard

Configure providers, inspect what happened, and prove it later, without shipping a release.

Configuration per environment

Providers, policies, branding, and claims are scoped to each environment, so staging never leaks into production.

Environment-scoped settings
Custom JWT claim mappings
Branding and hosted-page theming

Audit logs

Every authentication event recorded with actor, method, and outcome for security review.

Sign-in, MFA, and recovery events
Queryable history per user
Stream to your SIEM

Sessions and users

Search users, inspect sessions and devices, and revoke access from one place.

User search and profile edits
Session and device visibility
Immediate revocation

Embeddable components

Pixel-perfect UIs, embedded in minutes

Drop in prebuilt flows and account UI, or drive the same APIs from your own components.

<UserProfile />

Self-service profile, security settings, connected accounts, and session management.

Connect

Install one SDK or point your app at the hosted sign-in pages.

Configure

Enable the methods, providers, and factors you want per environment.

Ship

Go live with sessions, tokens, and audit logs at the edge.

Ready to ship secure sign-in?

Open the console to configure providers, policies, and environments in one place.

Start Building