An organization for every customer, with its own members and roles

Create an organization for each of your customers, then give it groups, roles, and a configuration of its own. Auth lets you assign a role to a whole group or to one member of the organization.

Read documentationView pricing

Group your users the way that each customer organizes its teams

Each organization in Auth has members, groups that match the customer's own teams, and roles that you can assign to a whole group in one call. Auth also stores the memberships, the invitations, and the settings for each organization, so your application can ask Auth which organizations a user belongs to and what that user may do in each one.

What you can set up inside each organization

Organization management

Create an organization with a name, a URL slug, and its own branding. You can look up the organizations of a given user or search organizations by a custom attribute.

Membership management

Add a user to an organization or remove one through the API. For each membership, Auth records the user's role in that organization, the date that the user joins, and any permission that applies in that organization alone.

Invitation flows

Invite a person by email to join an organization in a role that you choose. Auth expires the invitation after the number of hours that you set.

Organization groups

Create groups inside an organization and name them after its teams, such as Trading Desk or Ground Operations. When Auth checks a permission, it treats a group in the same way as a user account, so you can grant a group anything that you can grant a user.

Group-based role assignment

A role that you assign to a group applies to each member of that group. When you remove someone from the group, Auth revokes the permissions that they hold through it.

Organization roles

You can define roles for one organization alone, so the Reviewer role in one customer's organization can hold different permissions from the Reviewer role in another. Assign those roles to a member directly or through a group.

User provisioning

Create a user inside an organization in one step. Auth places the new user in the groups that you configure, grants the default roles of the organization, and sends a welcome email.

Organization settings

Store configuration and custom metadata for each organization. You can apply Auth settings to the whole application or to one organization, so one customer can have settings that differ from those of every other customer.

1 API call
To create an organization

You can add groups, roles, and invitations to it right away

1 action
To update team permissions

Change a group's roles once for all of its members

100%
Audit trail coverage

Auth logs every membership change

Build faster with solutions designed for real-world needs

Isolate tenant data through organization membership checks

Your workspace route creates an organization for each new customer workspace and makes the account that sends the request its owner. Before your code returns data from a workspace, it checks the user's membership with Auth, which grants access to the members of that organization alone, with the permissions of their roles.

Impact

The OrgSwitcher component in the sample shows the workspaces of the signed-in user and opens the one that the user picks. Auth keeps the record of which account belongs to which customer, so you will have no tenant table to maintain in your own database.

Prompt for a coding agent: Create an organization for each new workspace, and let users switch between their workspaces.

Conjoin IDE

Select a file to view its contents

Invite a teammate by email with a role and a 72-hour expiry

Call createInvitation with the email address, the roles, and the number of seconds before the invitation expires. Auth generates a secure token, sends the invitation in an email with your branding, and creates the membership with those roles when the person accepts.

Impact

In the sample, Quartermark invites Sebastian Vargas as an editor, with an invitation that expires after 72 hours. The call returns the invitation ID and the expiry time, which your code can log or show on an admin screen.

Prompt for a coding agent: Invite a teammate as an editor, with an invitation that expires after 72 hours.

Conjoin IDE

Select a file to view its contents

Give a new hire the Trading Desk roles by adding them to the group

Create a group with the roles that the team needs, such as trader and risk-reviewer for a trading desk. Every account that you add to the group holds those roles for as long as the account belongs to the group.

Impact

When a new trader joins Frostgate, Auth grants that account the trader and risk-reviewer roles as soon as your code adds it to the Trading Desk group.

Prompt for a coding agent: Give everyone in the Trading Desk group the trader and risk-reviewer roles.

Conjoin IDE

Select a file to view its contents

Give one user distinct roles in each organization

Assign each role to a membership, either to the user directly or through a group in that organization. The readEffectivePermissions call returns every permission that a user holds in one organization, whether the role behind it comes from a direct assignment or from a group.

Impact

A consultant can be an admin in one client's workspace and a viewer in another's while signing in with a single account. For the organization that the user selects, the workspace page in the sample lists the roles on their membership and the permissions that Auth returns, so the page shows different lists when the user switches workspace.

Prompt for a coding agent: Show the user's roles and permissions in the workspace that they select.

Conjoin IDE

Select a file to view its contents

Sync a department's members into one group with a single call

Create a group for each department, project, or job function, and give it the roles that the people in it need. The bulkSyncGroupMembers call adds every account on its add list and removes every account on its remove list in a single request.

Impact

The sample adds four dispatchers to the Ground Operations group at Bramblecourt Air and removes a fifth in one request. When you later change the roles of that group, Auth applies the change to every member at once.

Prompt for a coding agent: Add four dispatchers to the Ground Operations group, and remove a fifth, in one request.

Conjoin IDE

Select a file to view its contents

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access