Sign inStart building
Systems

Identity

People sign in with an emailed link or with Google or GitHub. There are no passwords to store, reset or leak. One person has one identity across your apps and a separate membership, with its own role, in each of them.

Add IdentityRead the guide

Magic links and OAuth

Email links that survive inbox scanners, plus Google and GitHub. Your site exchanges a single-use grant for a session with one request.

One identity across products

A user signs in once and joins each app separately, as a customer in one and an admin in another. Open sign-up is a per-app switch.

Organizations and roles

Teams, invitations, custom roles and fine-grained permissions, without writing an access-control layer of your own.

SSO and two-factor

Single sign-on per organization, authenticator codes with recovery codes, and step-up checks before sensitive actions.

Sessions you can see

Short-lived access tokens, rotating refresh tokens, and a list of every session that a user or an admin can revoke.

PasskeysIn preview

Device-bound sign-in as a third option beside links and OAuth.

In your code.

Send a sign-in link. The person lands back on your site with a grant.

TypeScript
await dianthan.auth.sendLink({
  email: "ada@example.com",
  returnTo: "https://fieldnotes.app/auth/callback",
});

// app/auth/callback/route.ts
const session = await dianthan.auth.exchange(searchParams.get("grant"));
cookies().set("session", session.refreshToken, { httpOnly: true });

Better with.

What Identity does once another system is switched on in the same app.

  • Billing

    Checkout already knows who is paying, and entitlements arrive with the session.

  • Flags

    Target a flag by role, organization or the plan someone is on.

  • Messaging

    Message a person, not an address, and respect the preferences they set.

  • Data

    Records can belong to a user or a team and are filtered to them automatically.

  • Models

    Every model call is attributed to a signed-in person, so caps and costs are per customer.

Endpoints.

The main routes. The API reference lists every parameter and response.

  • POST /v1/auth/magic-link
  • GET /v1/auth/oauth/:provider
  • POST /v1/auth/grants/exchange
  • POST /v1/auth/refresh
  • GET /v1/me
  • GET /v1/auth/sessions
  • POST /v1/organizations
  • POST /v1/organizations/:id/invitations
  • POST /v1/organizations/:id/roles
  • POST /v1/me/mfa/totp/setup

Included in the plan.

Identity is part of every account: free within hard limits, then included in the $29 plan that covers every system and every app.

  • Included

    10,000 monthly active users. Unlimited organizations. SSO for 1 organization.

  • Beyond that

    $0.005 per monthly active user. $20 per extra SSO organization.

Next: BillingAll pricing