NewManage apps from code with the Management API

Sign in with JustAuth.
Store nothing.

JustAuth is the identity provider for your app. Users sign in with a passkey or an email link, approve your app once, and you get back a verified profile. No passwords, no user table, no redirect_uri_mismatch.

Create an app Read the docs

Standard OAuth 2.0 with PKCE. Works with any OAuth client library, in any language.

Flow
app/login/page.tsx
// One link. No passwords, no user table.
<a href={`https://justauth.org/oauth/authorize
  ?response_type=code
  &client_id=${CLIENT_ID}
  &redirect_uri=https://acme.app/callback
  &scope=profile email
  &state=${state}`}>
  Sign in with JustAuth
</a>

Sign in to Acme

Welcome back.

↑ live preview, click through

  1. Your app
  2. Sign in with JustAuth: passkeys or email links
  3. Approve once
  4. Back in your app with a verified user

Building it yourself

Twelve chores. Zero features. One month gone.

This is what “just add a login page” actually means. JustAuth does all of it, so your app never stores a credential.

Doing it yourself

≈ 1 month, then forever
  1. 01Design a users table and migrations~2 hrs
  2. 02Hash and salt passwords (and pick the right algorithm)~1 hr
  3. 03Build sign-up, sign-in and forgot-password screens~1 day
  4. 04Send verification and reset emails that don't land in spam~4 hrs
  5. 05Add passkeys: WebAuthn ceremonies, attestation, fallbacks~2 days
  6. 06Rate-limit sign-in and lock out brute-force attempts~3 hrs
  7. 07Issue, store and expire sessions safely~4 hrs
  8. 08Keep a separate auth config for dev, preview and production~1 hr
  9. 09Write the callback handler: state, PKCE, token exchange~2 hrs
  10. 10Debug redirect_uri_mismatch on every preview deploy¯\_(ツ)_/¯
  11. 11Answer “I didn't get the email” support ticketsforever
  12. 12Hope nobody ever dumps your password tableforever

With JustAuth

3 steps
  1. 1
    Create an app

    In the dashboard or with one API call. Add http://localhost:* and your domains.

  2. 2
    /oauth/authorize

    Link your “Sign in with JustAuth” button here.

  3. 3
    /oauth/userinfo

    Exchange the code, read the user. Done.

“That’s it. That’s the whole list.”

passwords in your database
0
passwords in your database
OAuth endpoints to learn
3
OAuth endpoints to learn
consent per app, per user
1
consent per app, per user
redirect URI patterns per app
20
redirect URI patterns per app

Plain OAuth 2.0

No SDK required.

JustAuth speaks standard OAuth 2.0, so it works with the client library you already use, or a link and two fetch calls.

  • Authorization code flow with PKCE
  • client_secret_post or HTTP Basic at the token endpoint
  • userinfo with sub, name, email and picture
  • llms.txt so your coding agent can wire it up
index.html
<a href="https://justauth.org/oauth/authorize?response_type=code&client_id=ja_...&redirect_uri=https://myapp.com/callback&scope=profile%20email&state=RANDOM">
  Sign in with JustAuth
</a>

<!-- JustAuth sends the user back to:
     https://myapp.com/callback?code=...&state=RANDOM -->

Why it’s different

Auth you don’t have to run.

Everything that usually turns “add a login page” into a project, handled by JustAuth.

01

Your own identity provider

Add a “Sign in with JustAuth” button. Users sign in on JustAuth and approve your app on JustAuth’s consent screen. You never handle a password.

02

Standard OAuth 2.0

Authorization code flow with PKCE, a token endpoint and userinfo. Works with any OAuth 2.0 client library, or a few lines of fetch.

03

Every preview URL just works

Redirect URIs take wildcards: http://localhost:* for any port, https://*.preview.myapp.com for every preview deploy. No more redirect_uri_mismatch.

04

Consent once, remembered

Users approve each app one time for the scopes it asks for: openid, profile, email. After that, signing in is a redirect and back.

05

Apps as code

Create apps, edit redirect URIs and rotate secrets with the Management API and a personal API key. From CI, a script, or your coding agent.

06

Nothing stored in plain text

Client secrets, authorization codes, access tokens and API keys are stored hashed. Rotating a secret revokes the app’s tokens immediately.

Pricing

Four plans. Every price on this page.

Every plan gets every feature. You pay for monthly active users and nothing else. During early access, every plan is free.

Free

Side projects and prototypes.

$0/month

  • 1,000 monthly active users
  • No overage charges, ever
  • Community support

At 10k users: over the limit

Start free

Indie

Best for 10k

One product with real users.

$9/month

  • 10,000 monthly active users
  • $1 per extra 1,000 users
  • Email support, 2 business days

At 10k users: $9/mo

Start on Indie

Pro

Growing products.

$29/month

  • 50,000 monthly active users
  • $0.50 per extra 1,000 users
  • Email support, 1 business day

At 10k users: $29/mo

Start on Pro

Scale

High-traffic apps.

$99/month

  • 250,000 monthly active users
  • $0.30 per extra 1,000 users
  • Priority support, same business day

At 10k users: $99/mo

Start on Scale

10,000 monthly active users → Indie, $9/mo

5001M

Every plan includes

  • Sign in with JustAuth for your users
  • Unlimited apps with wildcard redirect URIs
  • OAuth 2.0 authorization code flow with PKCE
  • Management API and personal API keys
  • Dashboard of everyone who signed in
What counts as a monthly active user?
Anyone who signs in to one of your apps in a calendar month, counted once however many times they sign in or how many of your apps they use.
What happens past my limit?
Paid plans bill extra users in blocks of 1,000 at the price on the card. Free never charges: sign-ins keep working and we email you to upgrade.
Anything else on the bill?
No. No per-seat fees, no per-app fees, no setup fees, no sales call.

FAQ

Fair questions.

Anything else? The docs cover every endpoint, parameter and error.

Is JustAuth a wrapper around someone else’s login?+

No. JustAuth is the identity provider. Your app talks only to JustAuth, your users approve your app on JustAuth’s consent screen, and you get back a stable JustAuth user ID (sub).

Do I need an SDK?+

No. JustAuth speaks standard OAuth 2.0, so any OAuth client library works, or plain fetch: one redirect, one token request, one userinfo request. The docs have copy-paste examples.

What do my users see?+

A “Sign in with JustAuth” button in your app, then JustAuth’s sign-in and a consent screen with your app’s name and the data it asks for. They approve once; later sign-ins skip the screen.

Does it work with preview deployments?+

Yes. Register http://localhost:* and https://*.preview.myapp.com once and every port and preview URL is accepted. Plain http is allowed only on localhost.

Can my coding agent set this up?+

Yes. Point it at justauth.org/llms.txt. With an API key it can create the app and wire up the OAuth flow without opening a browser.

Stop building login.
Ship your app.

Your “Sign in with JustAuth” button is one app registration away.

Create an app Read the docs