Hosted login
Password, magic link, passkey, TOTP, recovery-code, and session-cookie flows for application sign-in — hosted and maintained so you don't have to.
Identity infrastructure for B2B SaaS
Ship your product.
We'll ship the auth.
Tenant-aware login, OIDC, and RBAC for B2B SaaS teams — hosted, standards-based, and migratable off Cognito. Your users and data stay portable, so you're never locked in.
- OIDC
- OAuth 2.0
- PKCE
- Passkeys
- TOTP
Built to pass your security review.
- Encryption in transit & at rest
- GDPR-aligned
- Full data export, no lock-in
- Audit-ready evidence
- Cloud of your choice
Platform
Auth built for tenants, not just users.
Organizations, environments, sessions, authorization checks, and audit evidence are first-class — because B2B auth is more than a login box.
OIDC sign-in
Environment-scoped issuers, discovery, JWKS, authorization code with PKCE, token exchange, userinfo, revoke, and logout endpoints.
Tenant-aware RBAC
Organizations, environments, memberships, roles, permissions, authorization checks, and session revocation as first-class product concepts.
Audit evidence
Security-sensitive actions and privileged admin changes leave durable, queryable event trails you can hand to your auditors.
Security & compliance
Built to pass your security review.
We run the infrastructure so your team doesn't — with the encryption, data controls, and audit evidence your customers' security questionnaires ask for. Hosted, but never locked in.
-
Encryption in transit & at rest
TLS on every connection and encrypted storage for user, session, and secret data.
-
Audit-ready evidence
Durable, queryable event trails that support your SOC 2 and ISO 27001 controls.
-
GDPR-aligned
EU-aware data handling, with a data-processing agreement available for production.
-
Full data export, no lock-in
Pull users, OAuth clients, memberships, and roles on demand, over open standards.
-
Data residency by design
Runs on AWS, pinned to a single account and region you choose.
-
Tenant isolation
Organizations and environments keep one customer's data separate from another's.
Migration
A practical path off Cognito.
Our first migration path targets SaaS teams already on Cognito user pools that want tenant-aware auth, clearer operator controls, and a product surface they can grow into — without a big-bang rewrite.
-
1
Import users and clients
Validate user exports, OAuth clients, membership mapping, and redirect URIs.
-
2
Rehearse the cutover
Test hosted login, OIDC discovery, token issuance, roles, and session behavior.
-
3
Switch new sessions
Move one organization environment at a time, with explicit operator control.
Not a slide deck
A running system, not a roadmap.
Running on API Gateway, Lambda, and DynamoDB, fronted by Cloudflare, today.
Authorization code flow with PKCE, validated against real backing data.
We're onboarding design partners and shaping the roadmap with them now.
Public signup
Create your Auth Yourself workspace.
Start with a hosted login, a production OIDC issuer, an owner account, and a workspace you control.