Login, solved. Ship it today.
Sign-up, sign-in, sessions, teams and MFA, as a drop-in component, a typed client, or a REST API. The screen on the right is real.
- 1 day
- to a working login
- 17ms
- to verify, offline
- $0
- to build and test
Sign in to Acme
Welcome back. Please sign in to continue.
Secured by ZevAuth
Verify locally
Trust a token without asking us.
A session is a signed JWT. Your server checks it against a key set it caches, so knowing who is calling costs nothing and never waits on a hop to us.
- 01 Your app A person signs in — hosted or embedded. ↓ id_token
- 02 ZevAuth Mints the session as a signed token, once. ↓ verify
- 03 Your backend Verifies it against keys it already holds.
- ~17ms
- to verify a token, in your own process
- 0
- round trips to us on a normal request
- 1
- rotating key set, cached per environment
Built for four different people.
Find yourself, and skip the argument written for everybody else.
Every way in, one screen.
Social sign-in, magic links, one-time codes and passwords. Turn on the ones you want; the screen adapts to what you enable.
- GitHub
- Apple
- Email and password
- Magic link
- One-time code
Plus Sign in with ZevID, the one-tap account shared across every Zev product.
Everything a login needs.
Six surfaces, one integration. Turn on what you need, when you need it.
A branded login you do not host.
Drop-in React, or the raw client.
Sessions your users can see and end.
B2B teams, roles and invitations.
Lockout, bot defence, breached passwords.
Every event, delivered and retried.
Built for agents
An API that explains itself.
An MCP server exists to translate for an API that cannot describe itself. This one can: discovery at the root, JWKS where the spec says, and an index of every doc, so an agent integrates without a human.
What an agent can do- No MCP server
- Nothing to install, host or keep in step with the API.
- Self-describing
- Discovery and JWKS at known paths, per environment.
- Errors that name the fix
- A code plus a sentence written for the caller.
- A map of the docs
- An llms.txt lists every page and what it covers.
$ curl https://api.zevauth.net/.well-known/openid-configuration
What comes back
- Issuer
- and JWKS to verify a token
- Every
- endpoint, from one index
- 15
- signed webhook events
One request, and an agent can verify a session and find every other endpoint. No adapter, no SDK, nothing to keep in step.
Drops into the stack you already run.
A React component set, a framework-agnostic JavaScript client, and a backend SDK. Or plain REST — a session is a signed JWT, so any language that can verify one is already supported.
- React
- Next.js
- Remix
- Vercel
- Vue
- Nuxt
- Svelte
- Astro
- Node.js
- TypeScript
- Expo
- JavaScript
Anything that can verify a JWT works, including the ones not listed. See the quickstart
Frequently asked questions
A few answers to the questions we hear most often.
How long does it take to add ZevAuth?
A working sign-in in an afternoon. Add a provider, drop in one React component, and sign-up, sign-in, sessions and password reset already work. Your own design takes a little longer and uses the same client underneath.
What does it cost?
Free to build and free to ship. A full test environment with its own keys, captured email and a token minter for CI costs nothing, and production runs free on generous limits while we drive early adoption. There are no paid plans yet and no surprise bill.
Do I have to use your sign-in screen?
No. Use the hosted screen for the fastest path, drop-in React components inside your own app, or build your own screen entirely on the JavaScript client or REST API. The sessions are the same underneath.
How do I check who is signed in on my server?
A session is a signed JWT. Your backend verifies it against your environment’s key set, cached locally, so checking a caller costs nothing and never waits on a request to us.
Can my users belong to teams?
Yes. Turn on organizations for an environment and users can belong to teams with roles and permissions you define, carried in the token. Start B2C and add it the day a customer asks, with no migration.
What sign-in methods are supported?
Email and password, magic links, one-time email codes, and social sign-in including Sign in with ZevID. You choose which to enable per environment, and the screen adapts.
Where is my users’ data kept?
Each environment is an isolated tenant with forced row-level security, so one app can never read another’s users. Uploads land in storage you control, and nothing about a user is fetched from a host we do not run.
Is it built for scale?
Yes. Lists paginate, the audit log is kept rather than truncated, tokens verify offline, and webhooks retry until they land. It is the same engine across every Zev product.
Start with a project and a key.
Free to build and to ship. Test and production both cost nothing today. Generous limits, no card, and no surprise bill.