Authentication infrastructure with a steady hand.
Hosted auth, project-scoped users, API keys, webhooks, audit logs, and localization in one reliable platform surface.
Reliable by design
Cookies, CSRF, scopes, and audit logs work together by default.
Who it serves
Built for product teams that cannot treat auth as a side page.
The provider is shaped for teams that need Clerk or WorkOS-level coverage while keeping their own API design and deployment posture.
Developer teams
Typed endpoints, scoped keys, JWKS, userinfo, and webhook delivery without leaking browser tokens.
SaaS platforms
Organizations, projects, users, and tenant boundaries stay visible to operators.
Security reviewers
Auditable controls, localized errors, and conservative session defaults are part of the product.
Product surfaces
Everything shares one reliable system.
Each surface is useful alone, but the platform feels reliable because the same tenant, session, locale, and audit rules run through all of them.
Interactive platform map
Hosted auth
Project-routed login, registration, password reset, and magic-link screens using the same session and localization core.
Included surface
Developer surface
API-first where it matters, hosted where it saves time.
Expose the primitives engineers expect while keeping policy and tenant rules centralized.
SDK-ready contract
The API shape is stable enough for SDKs without forcing the frontend to store tokens.
Webhook operations
Delivery state, subscribed events, and audit logs give operators a full feedback loop.
| Method | Endpoint | Use |
|---|---|---|
| POST | /v1/auth/{project}/login | Create a session through the hosted or API-driven flow. |
| GET | /v1/oauth/{project}/jwks | Publish project signing keys for token verification. |
| POST | /v1/platform/projects/{id}/webhooks | Register event destinations for user and auth lifecycle changes. |
Security posture
Built around controls teams already expect.
The product path favors boring, strong defaults: bounded requests, rate limits, redirect allowlists, scoped keys, localized errors, and auditable changes.
Browser sessions without token leakage
Credentialed browser requests use double-submit CSRF headers while sessions stay in HttpOnly cookies.
Cookie session boundary
Browser sessions stay in cookies protected from JavaScript token access.
Redirect allowlists
Redirects and origins are explicit project settings instead of wildcard defaults.
Structured audit records
Append-only entries make sensitive changes reviewable by operator, request, and target.
System language support
Hosted auth and API responses negotiate English, Traditional Chinese, and Simplified Chinese.
Scoped API keys
Server integrations use prefixed, hash-stored keys with project-level scopes.
Abuse-resistant traffic
Bounded payloads, rate limits, and idempotent delivery patterns reduce abuse windows.
Global readiness
Multi-language is a system behavior, not a page toggle.
The UI and API share locale negotiation so hosted auth, dashboard operations, and error handling feel native across supported languages.
Readiness paths
Adopt the platform in stages.
A practical sequence for moving from local auth to a provider-style platform.
Scale
Ready path
A calm auth control plane your team can trust.
Start from secure defaults, then turn on the enterprise identity surfaces your customers actually need.