One workspace. Every product.

The products

How it fits together

Everything hangs off your organization. Invite your team once and they have access to every product you enable. Sign in and you land on your TillDev home — a product-neutral hub — then move between products from the switcher in the top-left of the dashboard, or with the ⌘K command palette.

Domains

The split isn’t “one domain per product” — it’s one domain per audience.

You — the developer — run every product from the control plane at tilldev.dev (this dashboard) and the tilldev CLI. Each product also answers to a vanity subdomain there — auth.tilldev.dev, pulse.tilldev.dev — but they all resolve to the same workspace. TillPulse, TillCache and the rest live only here: they’re developer tools, so they never show a page to your end-users.

Your users only ever meet a product that renders pages to them. Today that’s TillAuth — its hosted sign-in lives under tilldev.app, addressed by tenant, not by product: <your-app>.tilldev.app (or your own custom domain). A login screen shouldn’t leak our product names, so there’s no auth. in the URL your users see. Any future product with an end-user surface joins the same tenant host on a path.

Company sign-in (SSO)

A workspace can let its people sign in with the company’s identity provider: any OpenID Connect provider, such as Google Workspace, Microsoft Entra ID, Okta, Auth0 or Keycloak. Owners and admins set it up under Settings → SSO or with tilldev sso set. The sign-in uses PKCE, and the provider’s ID token is checked against its published keys.

• Your provider never takes over an account on its own. Someone who already has a TillDev account connects it once: from Profile → Company sign-in while signed in, or from a link we email to the account’s own address the first time they use company sign-in.
• New accounts only on verified domains. Company sign-in creates an account only when the provider marks the address verified and its domain is one the workspace has proven it owns, by publishing a TXT record at _tilldev.<domain>. Subdomains of a verified domain count.
• Allowed domains (optional) limit which addresses the provider may sign in at all.
• Two-factor still applies. If your account has an authenticator, company sign-in (like Google or GitHub sign-in) asks for its code, or one of your recovery codes, before you are in. If the workspace requires two-factor and you have none yet, you go straight to setting one up.
• What disconnects it: resetting your password or accepting an invitation (either proves the inbox, so every company sign-in connected before is removed), disconnecting it on your profile, or an admin changing the provider’s issuer, which disconnects everyone.

tilldev sso set --issuer https://login.example.com --client-id <id> --client-secret-stdin
tilldev sso domains add example.com     # prints the TXT record
tilldev sso domains check example.com
tilldev sso links                       # your own connections

Register https://tilldev.dev/api/auth/sso/callback as the redirect URI with your provider. SCIM provisioning of workspace members isn’t available yet; invite and remove members in the workspace.

Google and GitHub sign-in

The same rule holds for Continue with Google and Continue with GitHub: a matching email alone never signs anyone in to an existing account. If your account has an authenticator, the first Google or GitHub sign-in asks for its code and connects after it. Otherwise we email your account’s own address a one-time link to connect it, valid for 30 minutes. You can also connect either one under Profile → Google and GitHub sign-in while signed in. A new email address still gets a new account. Resetting your password or accepting an invitation disconnects them, and you can disconnect one yourself as long as another way to sign in remains.

The CLI

Anything you can do in the dashboard, you can do from the terminal with the tilldev CLI:

npm i -g @tillstack/cli
tilldev login
tilldev pulse projects            # observability
tilldev auth apps                 # authentication
tilldev pulse ask "error rate today?"

Full CLI reference →