Auth and access control — without writing code
Flip on OAuth, API keys, or bring your own JWT issuer. Then add fine-grained, per-route authorization with OpenFGA — enforced on every request, in front of your unchanged backend.
- OAuth (GitHub, Google, Microsoft…), API keys, JWT/OIDC & opaque tokens
- Drop-in widgets: your users get API keys and manage groups on YOUR site
- Per-route authorization rules with OpenFGA — shadow-test before enforcing
- Tokens are verified, never stored — less compliance surface
# only the owner can read their order
GET /orders/{id} → allow if user == order.owner
# admins manage the catalogue
POST /products → allow if user in group:admins
Identity and access, handled for you
Authentication, any way
OAuth social logins, API keys, JWT/OIDC issuers or opaque tokens — switch with a setting, no code.
Fine-grained authz
Per-route rules with OpenFGA: ownership, roles, groups, attributes. Enforced on every request.
Shadow mode
Run new authorization rules in shadow against real traffic before you enforce them — no surprises.
IAM users & groups
Nested groups, abz.groups passed to your backend — managed in the CLI or the drop-in UsersGroupsWidget on your own site.
Keys on your dev page
The drop-in ApiKeyWidget lets signed-in users mint, rotate and revoke keys from your own site — plus a zero-config hosted portal.
Bring your own issuer
Trust Auth0, Okta or any JWKS-backed issuer per tenant — no key leakage across tenants.
Try it in 30 seconds
No signup required. Claim it to your account whenever you’re ready.