Authentication your users never notice.

I'm building an app and I never want to write auth again.

• Redirect, verify, refresh — three endpoints
• PKCE, rotating refresh tokens, signed webhooks
• Query params preserved through the whole flow

I run a membership and need a login my members trust.

• Your logo and colors on your own domain
• Import an existing roster in bulk
• Member directory, sessions and audit trail included

The whole integration

Three calls. That's the SDK.

Send the visitor to authorize, exchange the code for tokens, and rotate before they expire. It is plain OAuth 2.0 with OpenID Connect on top, so an off-the-shelf client library can do all three for you.

• Standards, not a dialectAuthorization code flow, PKCE, OIDC UserInfo. Nothing proprietary to learn.
• Your CSRF state survivesThe state you send comes back untouched — we set redirect params properly instead of concatenating.
• Relaxed redirect matchingRegister a base URL once and append query params freely at runtime.

// Read the signed-in user from your backend
const res = await fetch('https://youseemlegit.com/api/oauth/userinfo', {
  headers: { Authorization: 'Bearer ' + accessToken },
  cache: 'no-store',
})

if (!res.ok) return unauthorized()
const user = await res.json()

// user.sub, user.email, user.name,
// user.given_name, user.family_name, user.picture
session.set('userId', user.sub)

Sign-in methods

Every way in, on by default.

Your brand, not ours

Logo with a real crop-and-position editor, brand colors, button shapes. Nothing on the page says YouSeemLegit unless you want it to.

Your own domain

Point login.yourcompany.com at us and we resolve it, serve it, and keep the certificate valid. Users never leave your brand.

Bring your own OAuth apps

Use your own Google and LinkedIn credentials so the consent screen shows your company name — or fall back to ours to launch today.

Standards, not surprises

Authorization code flow with PKCE, redirect URI allow-listing, rotating refresh tokens. It behaves the way your library expects.

Sliding sessions

One-hour access tokens, thirty-day refresh, rotated on every use. Long-lived sessions without long-lived risk.

Signed webhooks

Every user event delivered as an HMAC-SHA256 signed POST, so your systems stay in step without polling.

Bulk import

Move an existing membership over in batches of a thousand, with de-duplication and per-row error reporting instead of all-or-nothing failures.

Real visibility

Sign-ins, active sessions, provider mix and a complete audit trail — per client, in the dashboard, not in a log aggregator.

Locked down by default

Rate limiting on every sensitive route, HttpOnly Secure SameSite cookies, hashed tokens at rest, monitored error reporting.

Case study

Rho Epsilon Iota moved 635 members off a hosted identity provider without a single reset email.

Accounts were imported in bulk, the cutover ran behind a feature flag on their side, and members kept signing in at the same address they always had. No downtime, no password resets, no support queue.

Security

Boring where it counts.

Authentication is the one part of your product where cleverness is a liability. Everything here is the conservative choice, applied consistently.