Auth for the AI era.
Humans, agents, and machines.
One identity model for everyone calling your product — humans logging in, agents acting on their behalf, and services authenticating with mTLS or M2M tokens. Same SDK, same audit, same policy engine.
Talk to sales →
Built by engineers from Rio
Auth wasn't designed for what you're shipping.
AI-native products launch multi-tenant on day one, with agents calling APIs on behalf of users and feature surface that compounds weekly. The auth tools you'd reach for were built for a different decade.
Teams building the next generation of SaaS.
If your product has humans logging in, agents calling APIs on their behalf, or services authenticating each other with mTLS or M2M tokens — Authaz is the auth platform you don't have to fight.
Patterns you'll find familiar.
Every way to authenticate. Human, agent, or machine.
Password, passkey, magic link, OAuth, SAML, MFA, M2M tokens, mTLS-pinned clients, and agent identities — one API, one audit trail, one place to configure. Whoever (or whatever) is calling, you get the same primitives.
How identity actually maps in B2B SaaS.
Tenant isolation isn't a flag in your token — it's how every layer thinks about access. Tokens, policy, and audit all carry organization context by default.
One identity model. Every token, policy, and audit row carries org context — no app-side bookkeeping.
Inside the auth path.
Every request lands at a regional edge, picks up tenant context from the resolver, runs through policy, and writes an audit row — all under fifty milliseconds.
- 1email entered
- 2IdP routed
- 3MFA verified
- 4JWT issuedok
- 1select org
- 2scope refreshed
- 3new token
- 4policy reloadedok
- 1admin sends
- 2email delivered
- 3invite accepted
- 4role assignedok
Ship your whole auth stack from one file.
Define providers, MFA, sessions, signup, and branding in version-controlled YAML. authaz apply diffs your file against the live tenant and applies the change — from local dev to staging to prod, no clicking around a dashboard.
apiVersion: authaz/v1 kind: Application metadata: name: acme etag: "5f3a2b1c" spec: authentication: providers: emailPassword: enabled: true minLength: 12 rejectBreached: true lockout: { maxAttempts: 5, durationMinutes: 15 } magicLink: enabled: true codeType: numeric codeLength: 6 codeExpiryMinutes: 15 oauth: - provider: google scopes: [openid, profile, email] mfa: mode: required allowedMethods: [totp, webauthn] primaryMethod: totp gracePeriodDays: 7 requireForAdmins: true session: timeoutMinutes: 480 idleTimeoutMinutes: 30 maxConcurrentSessions: 5 branding: preset: professional
$ authaz apply --file authaz.yaml + spec.authentication.providers.magicLink: enabled ~ spec.authentication.mfa.mode: optional → required + spec.authentication.mfa.allowedMethods: [totp, webauthn] + spec.authentication.mfa.requireForAdmins: true ~ spec.authentication.session.timeoutMinutes: 720 → 480 + spec.authentication.providers.oauth[google]: enabled ~ spec.branding.preset: indigo → professional 7 change(s) Apply these changes? y ✓ Updated application acme ETag: 9c4e1a8b… 7 change(s) applied.
Verify a session in five lines.
SDKs for the languages you ship in. Same primitives, same shape, same docs. No ten-call dance to get a user id.
Wire your stack to identity, not the other way around.
Subscribe once. Replay on demand. Every identity change in your tenant fires a typed event you can route to Slack, your CRM, or your own services.
Idempotency keys, exponential retries, replay window of 30 days.
Build against real auth, locally.
Sandbox tenants come pre-seeded with users, orgs, and roles. Local callbacks work out of the box — no ngrok choreography to log in.
$ authaz tenants create --seed dev $ authaz dev --port 3000 --tenant my-dev → Login URL: http://localhost:3000/auth/callback
Every action logged. Nothing to build.
Sessions, challenges, policy decisions, admin actions — immutable, filterable, exportable. Your SIEM, your S3, your choice.
Make it yours.
Custom domain, custom branding, buyer-provided IdPs — every login page feels like part of your customer's product, not a vendor stopover.
The wedge most identity platforms miss.
B2B SaaS lives or dies on three things: organizations, member access, and tenant-scoped permissions. Authaz is built around them — not around them as paid add-ons.
Everything enterprise asks for. Shipped, not roadmapped.
The features your largest customers ask about — SAML, SCIM, audit, FGA, multi-region — built into the same SDK as your first user's signup.
Security review becomes a checklist, not a project.
Authaz is engineered for SOC 2 and your largest customer's vendor security questionnaire. Encryption, isolation, and rotation aren't add-ons — they're defaults.
Sign-in keeps working — even when AWS doesn't.
Active-active across regions. Automatic failover. The auth path is the last thing in your stack you want flapping.
Already on Auth0, Cognito, or homegrown auth?
Most teams that move to Authaz come from one of three places. We have a path for each — and engineers who've done the migration before.
Predictable from your first user to your ten-thousandth tenant.
MAU-based pricing. Security included on every tier. No paywalled SAML.
Scale with the enterprise features built in.
- Up to 50k MAU
- SAML SSO + multi-tenant
- 7-day audit retention
Compliance and support for growing teams.
- Up to 500k MAU
- 90-day audit retention
- Priority support
One identity control plane for B2B SaaS.
Authaz is being built as the enterprise readiness infrastructure for B2B software — customer, workforce, and machine identity under a single model. Same primitives. Same audit. One contract.
Most teams run three identity stacks: one for customers, one for employees, one for services. Authaz collapses them into one — same model, same SDK, same audit.
Changelog
View all →Teams shipping auth, instead of building it.
When an entire AWS region goes down, your sign-in flow keeps working. Active-active across regions — from your first user to your ten-thousandth tenant, no rewrites along the way.
Stop building auth from scratch.
Ship the AI-era part of your product.
Drop in the SDK. Authenticate users, scope agents, sign service-to-service calls with mTLS or M2M tokens — audit every action. Get back to building the part of the product only you can build.