Auth that ships in a weekend. Scales through IPO.
Cross-browser passkeys (Chrome ↔ Safari ↔ Edge unified), passwordless flows, social login, SSO, SAML, SCIM, MFA — every modern auth primitive in a single SDK. The same user record carries through from B2C signup to B2B enterprise federation, with a documented upgrade path to PUF / TPM-bound credentials at Tier 1+ that bypass browser stores entirely.
Recommended tier: T0 General → T1 Standard
Category: Identity & Access
What Authentication & Users does
Cross-browser passkeys (FIDO2 / WebAuthn)
Most platform passkey solutions are bound to one ecosystem — Apple iCloud Keychain only works in Safari, Google Password Manager only in Chrome. Axowl's server-side multi-credential vault turns the Chrome-to-Safari switch into a 1-click additional enrollment, not a re-onboarding. Tier 1+ adds PUF / TPM-bound credentials that bypass browser stores entirely — one key, every browser, every machine.
SSO · SAML 2 · OIDC
Federate with Entra ID, Okta, Google Workspace, Auth0, Clerk, Cognito, and any SAML 2 / OIDC provider in minutes.
SCIM v2 provisioning
Bidirectional user / group sync with full deprovisioning. Departed staff lose access in seconds, not at the next quarterly review.
MFA — TOTP, push, hardware key
Per-org MFA policy. Hardware-key enforcement available from Tier 2 upward.
M2M & service tokens
RS256 / EdDSA signed JWTs with JWKS rotation. Per-service scopes; revocation propagated in seconds.
Magic links · social login
Apple, Google, Microsoft, GitHub, LinkedIn, KakaoTalk, Naver — out of the box.
Open SDK · framework-agnostic
Drop into React / Next / .NET / Go / Python. No vendor lock-in; standards-based JWT and OIDC.
Architecture in one paragraph
Drop the SDK in. Configure a tenant. Users authenticate against passwordless or social providers; the resulting identity travels through a sealed grant chain to every connected app. When you adopt Tier 1+, the same identity record gains a hardware-derived companion credential — no migration, no re-enrollment.
Three concrete deployments
Consumer signup
Email + passkey signup with social fallback. Zero password reset support burden.
Enterprise SSO onboarding
Customer brings their Okta / Entra ID; SAML federation in under an hour, with SCIM provisioning following same-day.
API / agent authentication
M2M tokens for service accounts and AI agents, scoped to specific resources, sealed in the audit chain.
T0 General → T1 Standard
Most teams start at T0 with software-sealed credentials. Compliance-driven workloads upgrade to T1 (vTPM) and inherit the same user records.
Versus what's deployed today
Today — Auth0 / Cognito / Clerk
Vendor-hosted user pool; vendor-controlled keys; per-MAU pricing escalates after the first 10K users; no path to hardware-bound credentials.
With DPSM — Authentication & Users
BYOA — runs in your AWS account. Standards-based identity portable across providers. Documented upgrade path to PUF-bound passkeys when compliance requires.