Add login in minutes. Ready for EU audits.

Security is the foundation of every plan

From Free to Enterprise, every plan ships the same authentication foundation — passkeys, MFA, and DPoP-bound tokens are not paywalled. You pay us for enterprise scale and operations, never for your users’ basic security.

• Social login

  Sign-in with Google, Microsoft, Apple, GitHub, LinkedIn, Facebook, Slack, and GitLab — 8 providers, available to configure on every plan, including Free.

• MFA / authenticator app (TOTP)

  Every user can turn on authenticator-app multi-factor login for their own account, free, on every plan.

• Magic link

  Passwordless sign-in via a one-time emailed link, on every plan.

• Email one-time code

  Passwordless sign-in via a one-time emailed code, on every plan.

• DPoP-bound tokens with key rotation

  Refresh tokens support cryptographic proof-of-possession binding, with automatic rotation and reuse detection, on every plan.

• Passkeys

  Passwordless, phishing-resistant sign-in with device passkeys, on every plan.

• Step-up authentication

  Re-verify identity with a passkey, password, magic link, or email code before a sensitive action — on every plan.

• Account linking

  Users can link multiple sign-in methods (social providers, passkeys, email) to one account, on every plan.

• User import that preserves password hashes

  Migrate existing users in bulk without forcing a password reset — original password hashes are preserved, on every plan.

• Statutory GDPR baseline

  Data processing agreement, sub-processor register, records of processing, and data export/erasure — required by law, so they are never gated behind a paid plan.