Auth infrastructure for SaaS
One login.
Every product.
Isolated orgs, standard JWTs, JWKS validation. Two lines with the .NET or Go SDK, or bring your own JWT middleware.
Pricing
One org. Everything included.
Unlimited users, unlimited apps. Only data retention differs between plans.
Starter
For side projects and early-stage products.
- Unlimited users
- Unlimited apps (OAuth clients)
- All auth methods
- 3-day data retention
Business
For production SaaS with compliance needs.
- Unlimited users
- Unlimited apps (OAuth clients)
- Full white-label branding
- 365-day data retention
- Priority support
Enterprise
Dedicated infrastructure, custom retention, SLA.
- Everything in Business
- Own servers
- Custom data retention
- Dedicated support + SLA
Integration
SDKs, REST, or raw JWT
Official SDKs for .NET and Go give you OIDC login, org switching, and JWKS validation in two lines. Full REST API for everything else. Or skip it all and validate JWTs directly.
NuGet package. Two calls in Program.cs - login, callback, logout, org switching handled.
builder.AddFFAuth();
app.MapFFAuthEndpoints();
Stdlib only - net/http. Middleware, OIDC, tenant resolution. No framework deps.
ffauth.MapAuthEndpoints(mux, opts, validator, onAuth)
Standard OIDC discovery, token exchange, user management, and org operations. Any language.
GET /.well-known/openid-configuration
POST /v1/connect/token
Capabilities
Everything you need. Nothing you don't.
Database-per-Org
Full data isolation. Each org gets its own database. No cross-tenant leakage.
SSO & Social Login
RSA-256 JWTs, JWKS validation, plus Google, GitHub, and Microsoft social login out of the box.
Org Scoping
Users scoped per org. Tokens carry org claims. Role-based access built in.
White-label
Custom branding, colors, logos. Your users never see ALKEYON.
MFA Enforcement
Require multi-factor authentication across your entire organization. TOTP-based, admin-enforced.
Audit Log
Track every login, password change, and settings modification. Filter by user, action, or date range.
Self-Service Registration
Let users sign up directly when enabled. Toggle per org - invite-only or open registration.
Ship products, not auth pages
Your next product starts with two lines. OIDC login, org switching, logout - all handled.