Features
Not a login form with a logo slot. A complete authentication layer — branding, methods, tokens, reporting and the support tooling you need the first time a member emails you at midnight.
The login page is a page of your product. It should look like it.
Upload once and crop, zoom and reposition until it sits correctly — stored as scale and offset, not a destructive crop.
Primary color, page background and button style, applied consistently across every screen in the flow.
Removes every trace of YouSeemLegit from the login, verification and reset pages.
Serve login from your own subdomain with a managed certificate and automatic apex redirects.
Open the real login page for any client straight from the dashboard before you point traffic at it.
Everything your users expect, and nothing they have to be taught.
bcrypt at cost 12, verified email addresses, progressive lockout after failed attempts.
Authorization code flow with PKCE on both, state bound to a single use.
Supply your own Google and LinkedIn credentials so the consent screen names your company.
Single-use, expiring links for members who would rather not keep a password.
Any authenticator app, with backup codes issued at enrollment.
A user who signs up with a password and returns with Google gets one account, not two.
Long-lived convenience without long-lived risk.
One-hour access tokens, thirty-day refresh, rotated on every use.
A legacy refresh route accepts and returns both camelCase and snake_case, for integrations that predate the OAuth endpoints.
Standard claims — sub, email, name, picture — from one bearer-authenticated call.
Kill an individual session or every session for a user, immediately.
Register a base URL once, then append query params at runtime without re-registering.
Answers in the product, instead of queries against your database.
Sign-ins over time, provider mix, new users, active sessions and verification rate.
Search across your users, open one, and see identities, sessions and recent activity.
Every active session with its client, age and expiry — revocable in place.
Filter by action, client, user or date range; export what you filtered.
Cross-client metrics, client management, and support tooling for the whole platform.
Three endpoints, plus events when you want to stop polling.
HMAC-SHA256 over the raw body, with the signature in a header you verify in constant time.
Up to 1000 users per batch, de-duplicated, returning 207 with per-row results on partial success.
Login, verification, password reset and 2FA challenge — all hosted, all branded.
API-key authenticated endpoints for provisioning clients and users from your own backend.
The conservative choice, applied everywhere.
Sliding windows on login, password reset and OAuth routes, backed by Redis.
HttpOnly, Secure and SameSite everywhere; eight-hour ceilings on administrative sessions.
TOTP required for platform administrators, not optional.
Exceptions captured and alerted on rather than discovered in a support ticket.
Sensitive actions are appended to a log that the application never updates or deletes.
Create an account, upload a logo, and open the live preview. It takes about two minutes and costs nothing.