Sign-in that's boring, in the best way.

We build the auth layer for products: passwords, SSO, magic links, and passkeys, sessions you can revoke, and roles scoped to a workspace. The part attackers probe first, built to hold.

A passkey user and an SSO user look identical to the rest of your code. Try a method, it's a read-only preview and collects nothing.

Start a build

Password

or continue with

Preview — no credentials are collected.

Every session, and a kill switch.

A stolen laptop shouldn't mean a stolen account. See every device signed in, where it is, and cut any of them off, or all but this one, in a click.

4 active sessions

MacBook Pro · Chromethis device

San Francisco, US · active now

current

iPhone 15 · Safari

San Francisco, US · 2h ago

Windows PC · Edgenew location

Berlin, DE · yesterday

iPad · Safari

San Francisco, US · 4d ago

Who can do what, on one screen.

Roles are scoped to a workspace and enforced on the server, not hidden buttons in the UI. Tap a role to trace its column.

Action

View data

Export data

–

Edit records

–

Invite members

–

Manage billing

–

Change roles

–

Delete workspace

–

One check on every request.

Tokens are signed and short-lived. Each request verifies signature and expiry, rotates quietly when it's about to lapse, and hands the rest of your code a user, a workspace, and a role. No long-lived secret sitting in a cookie for a year.

session.ts

1// every request carries a signed, short-lived session token;
2// verify it, and silently rotate one that's close to expiring
3export async function session(req) {
4  const token = req.cookies.get("sid");
5  if (!token) return null;
6
7  const claims = await verify(token, KEYS);   // signature + expiry
8  if (!claims) return null;
9
10  if (claims.exp - now() < ROTATE_WINDOW) {
11    await rotate(claims);                      // fresh token, same session
12  }
13  return { user: claims.sub, workspace: claims.ws, role: claims.role };
14}

Auth that isn't the thing that gets breached.

Every sign-in method behind one session model, revocable devices, server-enforced roles, and signed short-lived tokens. The boring, correct version.

Start a build The rest of Product