Auth answers who can do what in under 5ms

Define the roles in your application and assign them to your users. When your server needs to know whether a user may take an action, one API call to Auth returns the answer.

Read documentationView pricing

Auth resolves the roles behind every permission check

Auth works out each answer from the roles that the user holds, the roles that those roles inherit, and any permission that you grant on the resource itself. Your route handler makes one call and branches on the result, because Auth stores the roles, the assignments, and the grants that the answer depends on.

The roles, grants, and conditions that Auth evaluates

Role definitions

Create a role by giving it a name and a set of permissions, such as viewer, editor, or admin. You can also name roles after the jobs in your own product, so an insurance app can define a claims reviewer who may approve payouts.

Permission inheritance

A role can inherit the permissions of other roles. If admin inherits from editor and editor inherits from viewer, the RBAC engine grants an admin every editor and viewer permission, including any permission that you add to viewer later.

Resource-level permissions

Grant a permission on a single resource, such as one project, in addition to the permissions that a role grants across your application. With a viewer role and an edit grant on one project, a user can edit that project and view every other one.

Permission checking

The permission check takes an account, a permission key such as invoice.refund, and the type and ID of the resource. Auth returns whether the account is authorized, so your API can answer a false result with a 403 response.

Role assignment

Assign a role to a user for the whole application or for one organization only. Auth records the person who makes each assignment and the time that they make it, so you can show an auditor who granted each role.

Policy evaluation

A policy attaches conditions to a permission, such as a time window, an allowed IP range, or a rule that you write. Auth evaluates those conditions every time it checks the permission, so Auth can allow the same user during working hours and deny them outside those hours.

< 5ms
Permission check

Time that Auth takes to evaluate a check

Real-time
Permission updates

Auth applies a role change as soon as you save it

Full audit
Access history

Auth logs every permission check

Build faster with solutions designed for real-world needs

Hide the approve button by role and enforce the permission on the server

On the page, the has() helper from the React SDK checks for the loan-officer role, so only a loan officer sees the Approve button. The approve route sends the mortgage.application.approve permission and the application ID to Auth, which resolves the officer's roles and any grant on that application before it returns whether the officer is authorized.

Impact

If someone without the permission calls the approve route directly, the route handler returns 403. Because the route handler calls authorizeAction on every request, a change to a role in Auth takes effect on the next request.

Prompt for a coding agent: Show the Approve button only to loan officers, and check their permission again in the route.

Conjoin IDE

Select a file to view its contents

Add a role to a live application through the API

Create a role through the API or in the Conjoin Console, name the parent role that it inherits from, and attach its permissions. Auth stores the role with the rest of your roles, so you can create or change one with no new release of your application.

Impact

The sample creates a Dispatch Lead role that holds every dispatcher permission, plus route publishing, driver reassignment, and incident closing. Your application keeps its existing permission checks, while Auth grants route publishing to every user who holds the new role.

Prompt for a coding agent: Add a Dispatch Lead role with every dispatcher permission, plus route publishing.

Conjoin IDE

Select a file to view its contents

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access