Auth keeps your user table, from signup to password reset

Create user accounts, send verification emails, and reset passwords from your server through the Auth API. You can store a profile and your own JSON metadata on each account, then list your users by email address, phone number, reference ID, or status.

Read documentationView pricing

Auth stores your user accounts and sends the emails that go with them

Auth keeps each user's email address, password hash, profile fields, and custom attributes in one account record. Your application starts registration, email verification, and password resets with API calls, while Auth generates the tokens and sends the emails for each of those flows.

What Auth does for each user account

User registration

When a user signs up with an email address and a password, Auth stores the password only as a bcrypt hash and sends a verification email to the new address as part of the same signup.

Email verification

Auth emails each new user a verification link or a one-time code, depending on the flow that your app uses. The user can confirm the link on a page that Conjoin hosts, or your server can confirm the code through the API, after which Auth records the verified status on the account.

Password management

When a user asks to reset a password, Auth creates a secure reset token and emails the reset link, so your forgot-password page makes one API call.

Local token verification

Your server can verify a session token with the public keys from the JWKS endpoint, so your own process confirms the token with no network call to Conjoin.

Profile data

Each account has profile fields for a name, an avatar, and a phone number. You can add custom attributes for the data that only your application uses, for example a team name or a preferred language.

Custom metadata

Attach any JSON object to an account as metadata, such as a subscription plan, a notification preference, or the customer ID from your billing system. Auth accepts any keys that you send, so you can add a field to the metadata whenever you need one.

User search

Filter the accounts of an app by email address, phone number, reference ID, or status, and page through the results with a cursor.

Webhooks

Auth sends an HTTP request to your webhook URL when a user signs up, verifies an email address, or resets a password. Your application can start its own work from that request, such as creating a trial workspace, at the moment that the event happens.

bcrypt
Password hashing

The algorithm that Auth uses for every password

< 50ms
User lookup

Account retrieval time

Zero
Calls to Conjoin per session check

The Conjoin SDK verifies each session on your server

Build faster with solutions designed for real-world needs

Create a user account with a hashed password and your own metadata

Render the SignUp component, or create the account from your server. There, accounts.create takes the email address, the name, and your own metadata, and createPassword sets the password on the new account. Auth assigns the account a unique ID, records the creation time, and stores the password only as a hash.

Impact

Your route handler returns the new account ID, while Auth stores the signup source and the plan on that account as metadata. Because Auth hashes the password, your database holds no password or password hash.

Prompt for a coding agent: Create accounts from the server with a password, and store the signup source and plan on each.

Conjoin IDE

Select a file to view its contents

Verify an email address with a code inside your mobile app

When your app calls signUp from the useSignUp hook, Auth emails a verification code that expires after the period that you configure. Once Auth confirms the code that your app passes to attemptVerification, the hook signs the user in.

Impact

Your app collects the email address and the password on one screen and the six-digit code on the next. Auth generates, stores, and emails that code, so you write no server code for the signup.

Prompt for a coding agent: Verify the email address with a six-digit code during signup in the mobile app.

Conjoin IDE

Select a file to view its contents

List the active accounts in your app for a support tool

The accounts.list call filters the accounts of an app by status, reference ID, email address, or phone number. Each call returns one page of results at the limit that you set, with a cursor for the next page, however many users your application has.

Impact

The sample lists up to 50 active accounts, each with its name, its primary email address, the verification status of that address, and its creation time. A support tool that you build on this call contains no database query of its own.

Prompt for a coding agent: List up to 50 active accounts with their email addresses for our support tool.

Conjoin IDE

Select a file to view its contents

Verify every session on your own server

The Conjoin SDK fetches the public keys from the JWKS endpoint of your application, caches them, and verifies each session JWT on your server. Each verification adds less than a millisecond to the request, because the SDK makes no network call to Conjoin.

Impact

The proxy redirects a signed-out visitor from /dashboard to /sign-in with a returnTo parameter. In the orders route, verifyToken returns the account, session, and organization IDs from the token on your own server, so Conjoin applies no rate limit to your session checks, whatever your request volume.

Prompt for a coding agent: Verify sessions on our server, and send signed-out visitors from the dashboard to sign-in.

Conjoin IDE

Select a file to view its contents

Build your next app on Conjoin

Conjoin will open with a free Build tier, while the pricing page already lists the launch prices for Pro and Business. If you tell us what you're building, we'll talk you through early access.

See pricingGet early access