TILLAUTH · TILLDEV

Sign in. Stay signed in.
Stay you.

Passkeys. MFA. OAuth. Hosted login. SSO. All of it on every plan, on day one — because authentication isn't an upsell, it's the bedrock.

LIVE · gatekeeping
argon2id · signed tokens · refresh-token rotation
WHAT’S INSIDE

Everything, on every plan.

PasskeysGA

WebAuthn as a first-class primary credential — device-bound, phishing-resistant, and the smoothest way in your users will meet. Not a 2FA afterthought.

› Read the docs
MFA & recoveryGA

TOTP from any authenticator app, plus single-use backup codes for the day a phone goes missing. Enrollment, step-up, and recovery — all in the box.

› Read the docs
OAuth & SSOGA

Google and GitHub out of the box, plus generic OIDC for enterprise single sign-on. SCIM keeps users and groups in step with Entra ID, Okta or OneLogin, and your apps read groups from the token.

› Read the docs
Magic linksGA

Passwordless email sign-in with single-use, expiring links — network-bound and redirect-allow-listed, so a leaked link is a dead link.

› Read the docs
Sessions & tokensGA

Short-lived signed access tokens with refresh-token rotation. A replayed token kills the whole family, and every sign-in and refresh is scored for risk. One sign-in carries across your apps on that browser; revoke any live session from the dashboard.

› Read the docs
Audit & webhooksGA

An append-only audit log with a stable vocabulary, and signed, replay-protected webhooks so your systems hear about every sign-in, lockout, and admin action.

› Read the docs
EVERY WAY IN

Six front doors, one lock.

However your users choose to arrive, they land in the same session model, the same audit trail, and the same revocation controls. Pick the methods you want — none of them are gated.

CREDENTIAL

Email + password

The boring path, done right: modern memory-hard password hashing with a per-deployment pepper, and progressive lockout that slows repeated failures without locking out the real user.

WEBAUTHN

Passkeys

A primary credential, not a bolt-on second factor. Device-bound and phishing-resistant, with sign-counter regression caught as a cloned-authenticator signal.

SECOND FACTOR

TOTP + backup codes

Time-based one-time codes from any authenticator app, plus single-use backup codes for recovery. Enrollment and step-up verification are first-class, not a premium tier.

PASSWORDLESS

Magic links

Single-use, expiring email links, bound to the requesting network and checked against a per-app redirect allow-list. Convenient without handing phishers a free move.

SOCIAL

OAuth — Google & GitHub

The two providers most of your users already have, wired in with per-app client credentials kept encrypted at rest. The redirect is caught for you via the URL fragment.

ENTERPRISE

OIDC single sign-on

Bring any compliant OpenID Connect provider for per-org SSO — verified tokens, an allowed-domain gate, and the same session model as every other method.

THE SESSION LAYER

Signed in — and it stays that way.

An access token is short-lived and signed; a refresh token rotates on every use. If an old refresh token is ever replayed, TillAuth treats the whole family as compromised and revokes it — a stolen token buys minutes, not months.

Every sign-in and refresh is scored against the user's own history: a new browser, a new country, travel no airliner could make, a listed address. Watch the scores, or let your policy ask for one more proof, block the sign-in, or end every session of the user.

Sign in once and every app follows on that browser: the SSO session idles out, never outlives the sign-in behind it, and is scored for risk each time it's used.

Every live session is visible and revocable from the dashboard, with its device, address, country and risk. And because TillShield can reach into TillAuth, a security rule can revoke_sessions for a user the instant something looks wrong.

Session risk →
bash · app.bash
# See which sessions look wrong, and why
tilldev auth sessions my-app --risky

# One more proof at 60; block sign-ins and end everything at 90
tilldev auth apps update my-app --session-risk enforce

# What a sign-in answers past the line
#   200 { "mfa_required": true, "method": "email" }
#   403 { "code": "signin_blocked" }
# ...and a refresh
#   401 { "code": "reauth_required" }
#   401 { "code": "risk_revoked" }
# ...and when a spent token is replayed
#   401 { "code": "theft_detected" }
json · app.json
[
  { "paths": ["/healthz"], "action": "public" },
  {
    "paths": ["/billing/*"],
    "action": "allow",
    "require": { "groups": ["Finance"], "mfa": true, "fresh_minutes": 15 }
  },
  {
    "paths": ["/*"],
    "action": "allow",
    "require": { "domains": ["example.com"], "max_risk": "medium" }
  }
]
INTERNAL APPS

Your admin panel, behind your sign-in.

Keep nginx, Caddy, Traefik, Envoy or a Cloudflare Worker, or run the CLI as the proxy. On every request it asks TillAuth whether this person may reach this path, with a second factor, a recent sign-in, a calm session, from the right network, in the right group from your directory.

The tool behind it doesn't change. It receives who is asking as headers and a signed assertion bound to its host, checked in one line with createAccessVerifier.

Internal apps →
IN PRACTICE

React in five lines.

Wrap your app, call useSignIn, done. The provider auto-refreshes tokens before they expire and catches OAuth redirects via the URL fragment. Cookie-mode is a single config flag away.

React quickstart →
tsx · app.tsx
import { TillAuthProvider, useSignIn } from '@tillstack/auth-react'

<TillAuthProvider appId="tau_…">
  <App />
</TillAuthProvider>

function Login() {
  const { signIn, pending } = useSignIn()
  return <button onClick={() => signIn(email, password)} />
}
NOT A SILO

One identity, one workspace.

TillAuth isn’t a standalone login box — it’s the identity layer of the TillDev workspace you already have, so the rest of the family can act on who’s signed in.

01 · CONTROLS

The sessions Shield acts on

When a TillShield rule fires revoke_sessions or quarantine, it is ending a TillAuth session — the same session your users authenticate against. Security and identity share one source of truth.

02 · RECORDS

One audit log

Every sign-in, lockout, MFA change, and impersonation writes to the shared TillDev audit log, next to your Pulse and Shield events — one history, not three.

03 · SHIPS WITH

The same shell

One login, one bill, one set of members and roles. Add TillAuth to a workspace that already runs TillPulse and it inherits the org, the team, and the billing you already have.

WHAT WE DON'T DO

We don't paywall MFA. We don't ask "is this for production?" to unlock 100 users. Auth isn't an enterprise upsell — it's a defaultable primitive.

TURN IT ON

Authentication is the one thing you can’t bolt on cleanly later. Start with it right — passkeys, MFA, and SSO on day one, on every plan.

PART OF TILLDEV

One of seven.

You don't have to use the rest. But they fit together — same workspace, same audit log, same shortcut to switch between them. Add what you need when you need it.