Add login,
permissions, and SSO
 to your app

Sign your users in with a magic link, an OAuth provider, or their company's SAML connection, then check each user's permissions against the roles that you define. For your business customers, Conjoin Auth creates and deactivates employee accounts as each customer's directory changes.

Read documentationView pricing

One API for sign-up, login, and sessions

Auth creates each account at sign-up and returns the same kind of session at every later login, whether the user signs in with a password, an emailed link, an OAuth account, or enterprise SSO. Your application validates that session as a JWT on each request. You can also turn on MFA for your users and directory sync for your business customers through that same API.

Add accounts and session revocation

Agent is ready

Explore Auth capabilities

Open a feature below to see the API calls and the settings that it uses.

User management

Auth creates user accounts, sends verification emails, and resets passwords when your server asks.

Explore

Machine tokens

Auth issues, rotates, and revokes API tokens, each with its own scopes and request count.

Explore

Organizations

Create an organization for each of your customers, with its own groups, roles, and configuration.

Explore

RBAC

Auth answers in one API call whether a user may take an action under the roles that you define.

Explore

MFA

Auth enrolls each user in TOTP, SMS, email, or passkey verification and generates their backup codes.

Explore

Enterprise SSO

Auth signs a business customer's employees in through that customer's own SAML identity provider.

Explore

Guard

Auth Guard scores every login, signup, and MFA challenge to catch bots, brute force, and impossible travel.

Explore

What Auth does for sign-in, sessions, and access

Email and password authentication

Auth hashes every password before it stores it and checks each new password against passwords from known data breaches. Auth also sends a verification email to each new address and a reset link to any user who forgets their password.

Passwordless authentication

Auth signs a user in when they open the magic link or enter the PIN code that Auth sends to their email address.

Phone authentication

Auth texts a verification code to sign a user up or in with their phone number. To deliver each message, Auth picks the SMS carrier route for the country of the recipient's number.

OAuth provider integration

Auth signs users in with Google, GitHub, Microsoft, Apple, Slack, and the other major OAuth providers, so your users can sign in with an account that they already have. Through the universal client, Auth also connects to any other provider that supports OAuth 2.0 or OpenID Connect.

Enterprise SSO

Auth signs employees in through their company's Okta, Microsoft Entra ID, or other identity provider over SAML 2.0 or OIDC.

Directory sync

Auth provisions users and groups from a business customer's identity provider over SCIM 2.0 and updates each group's members to match the directory. When an employee signs in before the sync creates their account, Auth sets the account up at that first sign-in through just-in-time provisioning.

Organization management

Auth keeps each business customer's users in a separate organization, with its own member invitations, groups, and membership hierarchy.

Multi-factor authentication

Auth asks for a second factor by SMS, by email, or from an authenticator app, according to the enforcement policy that you configure.

Session management

For each session, Auth issues a JWT access token and a refresh token and records the device that the user signs in from. For OAuth sign-ins, Auth adds PKCE to the code exchange.

Role-based access control

A custom role contains the fine-grained permissions that you assign to it and every permission of the roles that it inherits from.

Audit logging

Auth logs every successful and failed login, password change, and security event, so you can show the record to an auditor or trace a failed sign-in.

Threat detection

Before Auth accepts a sign-in, Auth Guard checks it for bots, brute force, impossible travel, and other attacks on user accounts.

Free signups

Conjoin counts an account toward your bill only once its user signs in a day or more after the account's creation, which means that you pay nothing for a new signup until that user returns.

One connection for sign-on and directory sync

Conjoin bills an SSO connection once, whether or not you also turn on SCIM directory sync for it.

256-bit
Encryption

AES encryption for sensitive data at rest

< 10ms
Token verification

JWT validation and session checks

ISO 27001
Compliance

Security controls that map to ISO 27001:2022

Build faster with solutions designed for real-world needs

Sign users in with a one-time code that Auth emails to them

When the signIn function from the useSignIn hook sends an email address with the email_verification_code option, Auth emails a one-time code to that address. Once the hook returns the needs_verification status, the sample passes the code that the user types to attemptVerification. If the account also requires a second factor, the status changes to needs_mfa while mfaMethod holds the factor that Auth asks for. When that factor is totp, the sample sends the code from the user's authenticator app with attemptMfa.

Impact

When the status reaches complete, the sign-in page redirects the user to /dashboard. On each request to /dashboard, the conjoinProxy handler in the sample verifies the session cookie on your server before it redirects any visitor without a valid session to /sign-in.

Prompt for a coding agent: Let users sign in with a code that we email them, and ask accounts with MFA for an authenticator code.

Conjoin IDE

Select a file to view its contents

Conjoin signs, rotates, and invalidates your JWT sessions

For every session, Auth creates a JWT access token and a refresh token, each with an expiry that you configure. Through the sessions API, your server can check whether a session is still valid, revoke one session, or revoke every session that an account holds.

Impact

The sample account page lists each session that useSession returns, with its country, its IP address, the time of its last activity, and its expiry time. When the user signs out everywhere, the sample's server action reads their account from the session cookie and asks Auth to revoke every session of that account.

Prompt for a coding agent: Show users their active sessions, and add a button that signs them out on every device.

Conjoin IDE

Select a file to view its contents

Ask for an authenticator code before a user removes an email address

Auth accepts a step-up check only for one of its own sensitive operations, such as auth.email.remove. The server action in the sample requests a challenge for that operation on the user's session and sends the code from the user's authenticator app to stepUps.verify. Once Auth accepts the code, the action passes the step-up token from Auth to removeEmail.

Impact

When the code is wrong, stepUps.verify throws a ConjoinValidationError, so the action returns false before it calls removeEmail, after which the Fennick Market page asks the user for a current code. If you turn on step-up in the MFA settings of your app, Auth accepts a removeEmail call only when it carries a valid token for auth.email.remove.

Prompt for a coding agent: Ask for an authenticator code before a user can remove an email address from their account.

Conjoin IDE

Select a file to view its contents

Check any permission in one call, including the ones that a role inherits

Assign each user a role that you build from specific permissions. Because a role can inherit from another role, a catalog-admin role that inherits from catalog-editor includes every catalog-editor permission, so you define each of those permissions once.

Impact

In the browser, the has() helper checks for the catalog-admin role, so the sample renders the Archive button only for users who hold that role. Its API route checks the catalog.product.archive permission on the product with authorizeAction and answers with 403 whenever Auth returns authorized as false.

Prompt for a coding agent: Show the Archive button only to catalog admins, and check their permission again in the API route.

Conjoin IDE

Select a file to view its contents

Common questions about Conjoin Auth

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access