The protocol, completely
Authorization code with PKCE, refresh rotation, device code, token introspection and revocation, RP-initiated logout, dynamic client registration, and client credentials on Team and Business.
Identity infrastructure for multi-tenant products
A complete OAuth2 and OpenID Connect provider. Every tenant gets its own users, applications, branding and audit trail — isolated by the database, not by a filter somebody remembered to add.
Accounts people can keep
Passwords with recovery, TOTP, WebAuthn passkeys with discoverable credentials, email and recovery codes, SMS sign-in codes on Team and Business (US and Canadian numbers), and sign-out-everywhere. Self-service, so support is not the reset mechanism.
Machine identity that is sellable
Service accounts, audience-scoped tokens, secret rotation with an overlap
window, and private_key_jwt — so a client's credential never sits
at rest on our side. On Team and Business.
An audit trail that can be proved
Hash-chained records with structured detail, sealed periodically and timestamped by an RFC 3161 authority. Tampering with the middle of the chain breaks it visibly.
Web and native SDKs
JavaScript, React, Next, Vue, Svelte, Solid, htmx, Alpine, Alpine AJAX, Express, Fastify and a typed Management API client — with a backend-for-frontend so tokens never reach the browser. Native SDKs for iOS and Android are built, and not yet published.
Operable on purpose
Per-tenant encryption keys with rotation, webhook delivery with a dead-letter queue, metering, and health that distinguishes "starting" from "broken".