zyphr — sessionhostapi.zyphr.devsession ~/auth/ready
dev@zyphr:~/zyphr$
Auth-as-a-Service

Every way your users sign in

//Passkeys, social sign-in, magic links, email and SMS OTP, MFA, anonymous auth, and multi-tenant organizations — a complete identity platform behind one API. The auth-triggered emails come free.

Start for FreeRead the Docs
✓1,000 MAU free✓Passkeys · social · passwordless · MFA✓Organizations & anonymous auth
dev@zyphr:~/zyphr$
// Capabilities

A complete identity platform, not just a login box

Passkeys, social, passwordless, MFA, organizations, anonymous auth, and native gaming identity — 60+ endpoints across 16 API areas.

◎
Social Sign-In

Google, Apple, Facebook, GitHub, and Microsoft — with automatic account linking and server-side provider token access for calling downstream APIs.

⚿
Passkeys & WebAuthn

Full FIDO2 passkey support — registration, authentication, and credential management. Phishing-resistant sign-in with no password to steal.

✦
Passwordless

Magic links, email OTP, and SMS/phone OTP for both registration and login. Let users in without a password at all.

⛨
MFA / 2FA

TOTP enrollment and verification with single-use backup codes, regeneration, and per-user status — enforced at the API.

◇
Anonymous Auth & Conversion

Sign users in instantly with no credentials, then convert the guest account to a full one later — history and identity preserved.

⑃
Organizations & B2B

Multi-tenant organizations with members, roles, invitations, and mid-session organization switching baked into the token.

◈
Native Gaming Identity

Apple Game Center and Google Play Games sign-in, verified server-side. Players are recognized with no email, password, or redirect.

⊟
Sessions & JWTs

Refresh, revoke, and revoke-all across devices, with concurrent-session limits. RS256 by default with a public JWKS endpoint, so tokens verify offline.

⛊
Breach & Password Policy

Per-application password rules, live strength scoring, optional blocking of known-breached passwords, and account lockout with exponential backoff.

⊙
User Directory

Query, update, invite, and manage end users and their auth methods through a first-class server-side API.

✓
Verification & Recovery

Email verification, password reset with token validation, and change-password flows — with the messages delivered for you.

⟳
Provider Token Vault

Zyphr stores your users' OAuth provider tokens encrypted and refreshes them (Google, Microsoft), so your server can call downstream APIs on their behalf.

✉
Customizable Auth Emails

Every verification, reset, and magic-link email is fully templatable with version history and one-click rollback — delivered on Zyphr's own infrastructure.

⌖
Support Impersonation

Time-boxed, fully audit-logged user impersonation so your support team can debug an account without knowing a password.

dev@zyphr:~/zyphr$
// Developer-first

Modern auth in a few lines

Passkeys, social sign-in, guest-to-real account conversion, and org-scoped tokens with custom claims — all from one typed SDK. Verification emails and reset links send themselves.

200passkey.verified usr_9f2a
→org_7c1d · claims embedded
200session issued 52ms
sign-in.tsTypeScript
import Zyphr from '@zyphr-dev/node-sdk';
 
const zyphr = new Zyphr('zy_live_xxx');
 
// Passwordless: sign in with a passkey
const options = await zyphr.auth.webauthn.authentication.start({
  email: 'jane@example.com',
});
const { user, session } = await zyphr.auth.webauthn
  .authentication.verify({ credential });
 
// Social sign-in — Google, Apple, Facebook, GitHub, Microsoft
const { user: social } = await zyphr.auth.oauth({
  provider: 'microsoft',
  idToken,
});
 
// Guest now, real account later — no lost progress
const { session: guest } = await zyphr.auth.users.anonymous();
await zyphr.auth.users.convert({
  email: 'jane@example.com',
  password: 's3cur3P@ss',
});
 
// Embed authorization data directly in the JWT
const { session: scoped } = await zyphr.auth.login({
  email: 'jane@example.com',
  password: 's3cur3P@ss',
  organization_id: 'org_7c1d',
  custom_claims: { plan: 'enterprise', role: 'admin' },
});
dev@zyphr:~/zyphr$
// FAQ

Frequently asked questions

Complete. Zyphr ships passkeys/WebAuthn, social sign-in across five providers, magic links, email OTP and SMS OTP sign-in, TOTP MFA with single-use backup codes, anonymous auth with account conversion, multi-tenant organizations with role management, a full user directory, session and refresh-token management, custom JWT claims, configurable password policy, account lockout, GDPR export and erasure, and audit-logged support impersonation — across 60+ documented endpoints, with client SDKs for React and React Native and server SDKs in five languages.

Yes — full FIDO2/WebAuthn. Registration and authentication ceremonies, credential listing, renaming and deletion, and a per-user status endpoint. Passkeys are phishing-resistant and remove passwords from the login path entirely. Note that TOTP with backup codes is our second-factor method; passkeys ship as a standalone primary sign-in method.

Yes. Create organizations, manage members and roles, invite users, and switch the active organization mid-session — the organization is carried in the issued token, so your API can authorize on it directly. Roles are intentionally free-form so you can map your own taxonomy.

Four: passkeys/WebAuthn, magic links, email OTP, and SMS/phone OTP. Email and phone OTP work for both registration and login, so a user can create an account and sign in without ever setting a password.

Google, Apple, Facebook, GitHub, and Microsoft, with automatic account linking to existing email accounts. You can also retrieve stored provider tokens server-side to call downstream APIs on a user's behalf, with refresh supported for Google and Microsoft.

Yes. Sign a user in instantly with no credentials, then convert that guest into a full account later without losing their identity or history. This is a common fit for games and mobile apps where an account wall on first launch costs you users.

Yes. Zyphr verifies Apple Game Center and Google Play Games identities server-side and mints a normal Zyphr session — no email, no password, no OAuth redirect. The same platform player id resolves to the same user across devices.

Access tokens are JWTs. New applications default to RS256, so your services can verify tokens offline against the public JWKS endpoint at /.well-known/jwks.json — no callback to Zyphr on every request. HS256 is also selectable per application. Use server-set custom_claims for authorization decisions; the client-writable metadata field is untrusted by design.

Purpose-built client SDKs for React and React Native (session management, token storage, and hooks like useSession and useAuth) plus a framework-agnostic auth core. Server-side, the auth API is included in generated SDKs for Node/TypeScript, C#, Kotlin, Ruby, and Swift. There is also an MCP server exposing user and organization management to AI agents.

Not today. Zyphr covers OAuth 2.0 social sign-in, passkeys, passwordless, and MFA. SAML and OIDC federation for enterprise SSO are on the roadmap — if that is a hard requirement right now, tell us and we will be straight with you about timing.

Yes. Zyphr supports bulk user import with bcrypt-hashed passwords, so users keep their existing credentials without a forced reset. We provide migration guides for Auth0, Firebase Auth, and Cognito.

dev@zyphr:~/zyphr$ zyphr signup
200 OK — ready when you are

Auth without the compromise

1,000 monthly active users free. No credit card required.

Get Started Free