Private preview — the waitlist is open
Identity that fits the way your app works.
Hosted sign-in, organizations, and permissions, designed together. Give people a place in your app, and the right access when they get there.
- OAuth 2.0 and OpenID Connect
- Every self-service feature on Free
- Organizations and roles built in
Welcome back, Dana.
One account. A different role in each workspace.
Choose a workspace
Editor in Design studio
- Read a document
- Allowed
- Publish a document
- Allowed
- Invite a teammate
- Allowed
id_token claims
{
"iss": "https://acme.udibo.com",
"sub": "5d2c1e7a-…",
"email": "[email protected]",
"email_verified": true,
"org_id": "7c0a9b3e-…",
"org_slug": "design-studio",
"org_roles": [
"editor"
],
"roles": [
"billing"
]
}At a glance
- Sign-in methods
- Passwords, Google, GitHub, Discord, Apple, any OpenID Connect provider, email codes, and magic links.
- Second factor
- Authenticator apps with recovery codes, and step-up before sensitive actions on the hosted pages.
- Protocols
- OAuth 2.0 and OpenID Connect with discovery, JWKS, introspection, and refresh-token rotation.
- Webhooks
- Signed deliveries with a delivery log, retries, and a dead-letter queue you can redrive.
- Audit log
- Append-only administrative history with a per-user timeline and CSV or NDJSON export.
- Send from your own provider and domain, or let Udibo deliver codes, links, and invitations.
What it does
Three things every application needs from identity.
Know who someone is, where they belong, and what they may do there. Udibo answers all three with one integration.
Recognize the person
Hosted sign-in and account recovery on pages that carry your name, logo, and colors.
- Password, social, and passwordless sign-in
- Multi-factor authentication from the start
- Sessions people can see and revoke themselves
Give them a place
Organizations with invitations, memberships, and roles, so each customer's workspace stays its own.
- Invite by email, accept in one click
- One person in several organizations, a role in each
- The active organization in every token
Resolve what they can do
Permissions in your application's own words, resolved where the decision is made.
- Roles across a tenant, inside an organization, or on one resource
- Claims in the token for the common case
- A hosted check when you need the current grants
How it works
Three steps to a signed-in user.
A standard authorization-code flow, with the session held on your server.
- 01
Register your application
Create it in the dashboard, set the callback URL, and keep the client secret on your server.
- 02
Mount the backend and send people to sign in
Your backend exchanges the code and holds the session. The browser gets a cookie, never a token.
- 03
Read who they are and what they may do
Every token carries the active organization and its roles. Ask for a hosted check when the current grants matter.
import { Hono } from "hono";
import { DirectClient } from "@udibo/oauth2/client";
import { HonoBff } from "@udibo/oauth2/hono/bff";
const bff = new HonoBff({
client: new DirectClient({ issuer, clientId, clientSecret, redirectUri }),
sessionStore,
authRequestStorage,
resourceServer,
scope: "openid profile email",
defaultReturnTo: "/",
});
const app = new Hono();
app.route("/auth", bff.routes());
app.use("/api/*", bff.protect());import { BffClient } from "@udibo/oauth2/client";
const auth = new BffClient();
const { url } = await auth.login({ returnTo: "/" });
location.assign(url);Commitments
A foundation you can feel good building on.
The controls your application needs belong in the product from day one, not in a higher tier.
- Every self-service feature on Free
- Explore the whole product from the beginning. Paid plans add capacity; security, branding, and data export are part of the foundation.
- Your brand at the front door
- Your own name, logo, and colors on the pages your users sign in through. They should recognize the application they came to use.
- A record you can work with
- Inspect administrative changes in the audit log and export them as CSV or NDJSON. Every plan includes at least 90 days of history.
- A clear path in, and out
- Connect using OAuth 2.0 and OpenID Connect. Import existing users and export your data yourself, including credential material.
Pricing preview
Start small. Keep your options open.
Free to begin. A $5 monthly starting point when you need more capacity, plus metered usage. The same self-service features on both plans.
The controls other vendors sell as upgrades, such as multi-factor authentication, custom roles, organizations, and audit history, are on Free. We charge for growth instead.
Free
$0per month
- Monthly retained users
- 500
- Hosted permission checks
- 25,000
- Emails sent by Udibo
- 1,000
No card, no trial clock.
Standard
$5per month + usage
- Monthly retained users
- 5,000
- Hosted permission checks
- 250,000
- Emails sent by Udibo
- 10,000
Only usage above the allowance is metered.
Included amounts are per identity tenant, per month. Above Standard's allowance, usage is metered at $3.00 per 1,000 users, $10.00 per 1,000,000 checks, and $1.00 per 1,000 emails. Preview numbers, pending validation before launch.
Starters
Start where your application starts.
Follow a working starter, connect an existing application, or give your coding agent the integration context.
01
A business application
Onboard organizations, invite teammates, and keep each customer's access scoped to its own workspace.
02
A consumer application
Give people a familiar sign-in flow and manage their account without asking them to belong to an organization.
03
A client portal
Share specific documents with specific people, and check access when someone opens a resource.
Used here first
Built with care. Used here first.
Udibo's own dashboard uses this identity service. We work with the same sign-in flows, organizations, and permissions that we ask you to build on.
Open standards
An open path forward.
Connect from any OpenID Connect client. Built in TypeScript, with an identity core planned for release under the MIT license when the hosted service opens to the public.
Give your next idea a place to grow.
Join the waitlist for access as the private preview opens up.