# Zyphr — Developer Auth & Communications Platform
> The developer platform for user authentication, transactional messaging, and webhook delivery.

## What is Zyphr?
Zyphr is a unified API for user authentication, transactional email, push notifications, SMS, in-app messages, and webhooks. Built by ArcRaz LLC, it consolidates 5+ vendor integrations into a single developer-friendly platform — replacing an Auth0 + SendGrid + OneSignal + Svix stack with one API, one dashboard, and one bill.

## Key Facts
- One API for auth, email (SES), push (APNs/FCM/Web Push), SMS, in-app, and webhooks
- Complete Auth-as-a-Service: passkeys/WebAuthn, social sign-in, passwordless, MFA, organizations, anonymous auth
- 16+ provider integrations: SendGrid, Mailgun, Postmark, Twilio, Plivo, Slack, Discord, Microsoft Teams, and more
- TypeScript SDK with full type definitions — install: `npm i @zyphr-dev/node-sdk`
- Client auth SDKs for React and React Native; server SDKs in Node, C#, Kotlin, Ruby, and Swift
- Standard Webhooks specification with HMAC-SHA256 signatures
- Plans: Free (1,000 MAU + 1,000 emails/mo), Starter ($29/mo), Pro ($79/mo), Scale ($249/mo), Enterprise (custom)

## Authentication (Auth-as-a-Service)
Zyphr is a complete identity platform, not a login box. Capabilities:

- **Passkeys / WebAuthn** — full FIDO2 support: registration and authentication ceremonies, credential listing, renaming, and deletion, per-user status.
- **Social sign-in** — Google, Apple, Facebook, GitHub, and Microsoft, with automatic account linking. Provider tokens are stored encrypted and refreshable (Google, Microsoft) so your server can call downstream APIs on a user's behalf.
- **Passwordless** — magic links, email OTP, and SMS/phone OTP, each supporting both registration and login.
- **MFA** — TOTP enrollment/verification with single-use backup codes and regeneration. (TOTP + backup codes are the second-factor methods; email and phone OTP are primary sign-in methods.)
- **Anonymous auth** — sign users in with no credentials, then convert the guest to a full account without losing identity or history.
- **Organizations** — multi-tenant orgs with members, roles, invitations, and mid-session organization switching carried in the token. Role values are free-form so you can map your own taxonomy.
- **Native gaming identity** — Apple Game Center and Google Play Games, verified server-side, with no email, password, or OAuth redirect.
- **Sessions & tokens** — refresh, revoke, revoke-all, concurrent-session limits, and configurable duration. New applications default to RS256 with a public JWKS endpoint at /.well-known/jwks.json, so tokens verify offline. HS256 is also selectable.
- **Custom claims** — server-set custom_claims are embedded in the JWT for authorization decisions. The client-writable user `metadata` field is untrusted by design.
- **Password security** — per-application policy (length, character classes), a password-strength endpoint, and opt-in blocking of known-breached passwords via k-anonymity HIBP lookup.
- **Account protection** — account lockout with exponential backoff, plus tiered Redis-backed rate limiting.
- **User management** — full user directory, invitations, auth-method listing, account merge, GDPR data export and erasure.
- **Support tooling** — time-boxed, fully audit-logged user impersonation; auth request logs and an organization audit log.
- **Customizable auth emails** — every verification, reset, and magic-link email is templatable with version history and one-click rollback, delivered on Zyphr's own infrastructure.

Not supported today: SAML and enterprise OIDC federation (no SCIM). Enterprise SSO is on the roadmap.

## Documentation
- Docs: https://zyphr.dev/docs/
- Auth guide: https://zyphr.dev/docs/guides/auth-as-a-service
- API Reference: https://zyphr.dev/docs/api/introduction
- OpenAPI spec (machine-readable): https://api.zyphr.dev/docs/openapi.json
- Quickstart: https://zyphr.dev/docs/getting-started/quickstart

## Pages
- Home: https://zyphr.dev/
- Auth: https://zyphr.dev/auth/
- Platform: https://zyphr.dev/platform/
- Email: https://zyphr.dev/email/
- Push: https://zyphr.dev/push/
- Webhooks: https://zyphr.dev/webhooks/
- Features: https://zyphr.dev/features/
- Pricing: https://zyphr.dev/pricing/
- Integrations: https://zyphr.dev/integrations/
- Blog: https://zyphr.dev/blog/
- About: https://zyphr.dev/about/
- Contact: https://zyphr.dev/contact/

## Company
- Legal entity: ArcRaz LLC
- Location: Las Vegas, Nevada, USA
- Website: https://zyphr.dev
- Support: support@zyphr.dev
- Sales: sales@zyphr.dev