TILLAUTH · TILLDEV

Sign in. Stay signed in.
Stay you.

Passkeys. MFA. OAuth. Hosted login. SSO. All of it on every plan, on day one — because authentication isn't an upsell, it's the bedrock.

LIVE · gatekeeping
argon2id · signed tokens · refresh-token rotation
WHAT’S INSIDE

Everything, on every plan.

PasskeysGA

WebAuthn as a first-class primary credential — device-bound, phishing-resistant, and the smoothest way in your users will meet. Not a 2FA afterthought.

› Read the docs
MFA & recoveryGA

TOTP from any authenticator app, plus single-use backup codes for the day a phone goes missing. Enrollment, step-up, and recovery — all in the box.

› Read the docs
OAuth & SSOGA

Google and GitHub out of the box, plus generic OIDC for enterprise single sign-on. Per-app client credentials, kept encrypted at rest.

› Read the docs
Magic linksGA

Passwordless email sign-in with single-use, expiring links — network-bound and redirect-allow-listed, so a leaked link is a dead link.

› Read the docs
Sessions & tokensGA

Short-lived signed access tokens with refresh-token rotation. A replayed token kills the whole family. Revoke any live session from the dashboard.

› Read the docs
Audit & webhooksGA

An append-only audit log with a stable vocabulary, and signed, replay-protected webhooks so your systems hear about every sign-in, lockout, and admin action.

› Read the docs
EVERY WAY IN

Six front doors, one lock.

However your users choose to arrive, they land in the same session model, the same audit trail, and the same revocation controls. Pick the methods you want — none of them are gated.

CREDENTIAL

Email + password

The boring path, done right: modern memory-hard password hashing with a per-deployment pepper, and progressive lockout that slows repeated failures without locking out the real user.

WEBAUTHN

Passkeys

A primary credential, not a bolt-on second factor. Device-bound and phishing-resistant, with sign-counter regression caught as a cloned-authenticator signal.

SECOND FACTOR

TOTP + backup codes

Time-based one-time codes from any authenticator app, plus single-use backup codes for recovery. Enrollment and step-up verification are first-class, not a premium tier.

PASSWORDLESS

Magic links

Single-use, expiring email links, bound to the requesting network and checked against a per-app redirect allow-list. Convenient without handing phishers a free move.

SOCIAL

OAuth — Google & GitHub

The two providers most of your users already have, wired in with per-app client credentials kept encrypted at rest. The redirect is caught for you via the URL fragment.

ENTERPRISE

OIDC single sign-on

Bring any compliant OpenID Connect provider for per-org SSO — verified tokens, an allowed-domain gate, and the same session model as every other method.

THE SESSION LAYER

Signed in — and it stays that way.

An access token is short-lived and signed; a refresh token rotates on every use. If an old refresh token is ever replayed, TillAuth treats the whole family as compromised and revokes it — a stolen token buys minutes, not months.

Every live session is visible and revocable from the dashboard, with its device, IP, and issue time. And because TillShield can reach into TillAuth, a security rule can revoke_sessions for a user the instant something looks wrong.

Sessions & tokens →
ts · app.ts
// Kill one session — or every session for a user.
await tillauth.sessions.revoke(sessionId)
await tillauth.users.revokeAllSessions(userId)

// Refresh rotates the token on every use. Replay a spent
// refresh token and the whole family is revoked on the spot:
//   401 { error: "token_reuse_detected" }
IN PRACTICE

React in five lines.

Wrap your app, call useSignIn, done. The provider auto-refreshes tokens before they expire and catches OAuth redirects via the URL fragment. Cookie-mode is a single config flag away.

React quickstart →
tsx · app.tsx
import { TillAuthProvider, useSignIn } from '@tillstack/auth-react'

<TillAuthProvider appId="tau_pub_…">
  <App />
</TillAuthProvider>

function Login() {
  const { signIn, pending } = useSignIn()
  return <button onClick={() => signIn(email, password)} />
}
NOT A SILO

One identity, one workspace.

TillAuth isn’t a standalone login box — it’s the identity layer of the TillDev workspace you already have, so the rest of the family can act on who’s signed in.

01 · CONTROLS

The sessions Shield acts on

When a TillShield rule fires revoke_sessions or quarantine, it is ending a TillAuth session — the same session your users authenticate against. Security and identity share one source of truth.

02 · RECORDS

One audit log

Every sign-in, lockout, MFA change, and impersonation writes to the shared TillDev audit log, next to your Pulse and Shield events — one history, not three.

03 · SHIPS WITH

The same shell

One login, one bill, one set of members and roles. Add TillAuth to a workspace that already runs TillPulse and it inherits the org, the team, and the billing you already have.

WHAT WE DON'T DO

We don't paywall MFA. We don't ask "is this for production?" to unlock 100 users. Auth isn't an enterprise upsell — it's a defaultable primitive.

TURN IT ON

Authentication is the one thing you can’t bolt on cleanly later. Start with it right — passkeys, MFA, and SSO on day one, on every plan.

PART OF TILLDEV

One of seven.

You don't have to use the rest. But they fit together — same workspace, same audit log, same shortcut to switch between them. Add what you need when you need it.