Passkeys and sign-in for your SaaS, without an auth service
Last updated
Seed signs people in with passkeys, sign-in links by email, Google and GitHub, checked by its own API on your server, with no third-party auth service. Passwords, passkeys and sign-in links work as soon as you deploy, with no fee per user; Google and GitHub each need two keys in the env file.
- Passwords hashed with PBKDF2-SHA-256 through Web Crypto, 600,000 rounds by default
- Signed session cookies, and an audit trail of every sign-in event
- Personal API tokens, stored only as keyed hashes
- Passkeys: only the public key is stored, and each sign-in challenge works once
- Magic links: one link signs in or signs up, works once, for 15 minutes, and is stored only as a hash
- Guest accounts (anonymous sign-in): a visitor starts with one click and no sign-in method, then adds an email and password, Google, GitHub or a passkey to the same account
- Wrong passwords counted per sign-in name across every network address, then a short lock
The API checks every sign-in itself and answers with a signed session cookie. A passkey uses the browser's own WebAuthn: the server keeps only its public key, and each sign-in challenge works once. A sign-in link signs in or signs up, works once, for 15 minutes, and is stored only as a hash.
An authenticator app adds two-factor sign-in. The profile lists every way into the account and every signed-in device, and changing a way in asks for proof and sends an email. A visitor can also start in a guest account and add a way to sign in later.
Do I need an auth service?
No. Seed's own API checks passwords, passkeys, sign-in links and the answers from Google and GitHub, on your server, so nothing is billed per user.
Does Seed support passkeys?
Yes. People add a passkey on their profile and sign in with it; the server stores only its public key, and each sign-in challenge works once.
Does Seed have two-factor authentication?
Yes. An authenticator app adds a one-time code at sign-in, also after a sign-in with Google or GitHub.
Can I leave Google or GitHub sign-in out?
Yes. Each one is off until both of its variables are set in the env file, so leaving them out turns it off.
Does Seed run on Node or Bun?
Not yet. Runs on Deno today; Node and Bun support is planned (#623).