Sign in. Stay signed in. Stay you.

The data model

TillAuth has four primary objects:

• Apps — one per customer-application. Each app has its own OAuth client IDs, branding, hosted-login slug, and encryption key.
• Users — end-users of an app. Email is unique within an app.
• Sessions — refresh tokens with rotation + theft detection.
• Identities — links to OAuth/OIDC providers (Google, GitHub, etc.).

The full mental model — and how MFA, passkeys, devices, and audit fit into it — is in Concepts.

Every flow, day one

Every common auth flow, on every plan, on day one.

• Email + password — modern hashing, peppered, progressive lockout after repeated failed attempts.
• Passkeys — WebAuthn primary and 2FA, with counter-regression theft detection.
• TOTP + backup codes — first-class, not an upsell.
• Magic links — network-bound, redirect allow-list checked.
• OAuth · Google + GitHub — per-app client IDs, encrypted client secrets.
• OIDC SSO — verified sign-in tokens, optional allowed-domain gate.

Get started

Five lines of React. Open the quickstart →

Build on the API

• API reference · OpenAPI — the end-user /v1 surface, machine-readable at auth.tilldev.dev/openapi.json.
• Embedded account settings — password, passkeys and 2FA management in your settings UI; the hosted pages are clients of the same API.
• Workers + edge runtimes — verify sessions on workerd / Deno / Bun; the SDK is jose on Web Crypto.

Operate

• Webhooks — HMAC-signed delivery, exponential-backoff retries, replay view.
• Audit log — append-only, stable action vocabulary, 365-day retention.
• Custom domains — auth.your-domain.com on customer DNS.

SDKs

• @tillstack/auth-react — provider + hooks for SPAs and Next.js apps.
• @tillstack/auth-node — JWT verifier, Express middleware, cookie-proxy; edge-native (Workers guide).