Primitives
Everything you need,
nothing you don't.
Secure by default
Argon2id, AES-256-GCM encrypted secrets, JWKS rotation, strict webhook signature verification.
Multi-tenant
Org → App → Instance. Every query scoped by environmentId. Hard isolation built in from day one.
Fast SDKs
Verify sessions server-side, read session in React, protect routes with Next.js middleware.
Passkeys & MFA
WebAuthn, TOTP, SMS fallback. Enforce at the instance level or per user.
Magic links
Signed, single-use, rate-limited. Custom domains and templates included.
Own your keys
JWKS you control. Rotate signing keys without downtime. Bring-your-own KMS.
Drop-in
Ten lines to production auth.
Wrap your tree, get typed session hooks, and ship. No boilerplate, no custom headers, no state machines to maintain.
app/providers.tsx
import { KolayLogin } from '@kolaylogin/react';
export default function App({ children }) {
return (
<KolayLogin.Provider publishableKey={env.KL_PUB}>
<KolayLogin.SignedIn>
{children}
</KolayLogin.SignedIn>
<KolayLogin.SignedOut>
<KolayLogin.SignIn />
</KolayLogin.SignedOut>
</KolayLogin.Provider>
);
}