Auth for startups moving upmarket.

Signet is the sign-in system for your app. Your enterprise customers bring their own SSO, their AI agents get in when their identity provider allows it, and your price stays flat.

Start free Read the docs

Hobby is $0 with no card, and your instance is ready about a minute after you confirm your email. Team is $299 a month, flat, with unlimited SSO connections.

Signet works with the stock better-auth client. Already on better-auth? Keep your client and change one URL.

.env.local
BETTER_AUTH_URL=https://yourapp.comSIGNET_URL=https://yourapp.signetauth.dev/api/auth
bun add better-author npm i better-auth

Quickstarts for Next.js React React Router Express Vue Svelte

Try it. You are Pied Piper; Hooli, Raviga and Aviato are your enterprise customers, all made up. Click a row, then press J K to move and R to revoke.Try it. You are Pied Piper; Hooli, Raviga and Aviato are your enterprise customers, all made up. Tap a row to see what you can do with it.

piedpiper piedpiper.signetauth.dev
Demo data
Plan

Tested end to end against real identity systems

Microsoft Entra IDSAML, OIDC and SCIM against a live tenant

OktaA SAML sign-in round trip, 16 Aug 2026

Proxmox VEA three-node cluster signing in through one realm
HeadscaleA self-hosted Linux fleet, with no Signet code changes
better-authThe stock client, pointed at one URL

Built for the deal that stalls in security review.

Your first enterprise customer sends a spreadsheet of questions. These three decide whether the deal closes this quarter or next year.

Do you support SSO with our identity provider?

Yes, over SAML and OIDC, with as many connections as you have customers. Team is $299 a month however many you add.

Enterprise SSO connections
6

Signet Team$299

Clerk Pro, list price on 25 Oct 2026

Limits

Clerk's list price is lower up to 4 connections; from the 5th, Team costs less. Clerk's pricing page, read 25 October 2026: Pro is $25 a month with one connection, then $75 a month for each one after that, up to 15. The full comparison. Tested against Microsoft Entra ID and Okta; SSO cannot yet be made the only way in for a domain.

How fast does a leaver lose access?

When your customer removes someone in their identity provider, SCIM takes them out of that organization and ends their sessions and OAuth tokens. A password reset ends every session by default, inside the same database transaction, so a stolen cookie does not outlive it.

Raviga's Entra ID removes jonas@raviga.example over SCIM
Signet takes Jonas Weber out of Raviga and ends Jonas's sessions and OAuth tokens
Milo Ruiz resets their password
Signet ends both of Milo's sessions in the same transaction
Limits

SCIM provisioning and removal are proven with a live Microsoft Entra tenant. The account itself stays, by design; its access to that organization ends.

Can we take our data with us?

Yes. Your users and sessions live in a database dedicated to you, PostgreSQL from Team up. Leaving is pg_dump and pg_restore.

$ pg_dump -Fc -f signet.dump "$SIGNET_DB"
$ pg_restore -d "$NEW_DB" signet.dump
# start Signet with the same main secret
Limits

The instance's main secret lives outside the database, and the restore needs it. Running Signet yourself needs a Scale licence. Hobby's encrypted SQLite takes one more step, in the export guide. On the hosted service, you ask and we hand you the dump.

Their next question: how do our agents get in?

Your enterprise customers are putting AI agents to work, and they want those agents in your product too. They want their own identity provider to decide which agents get in, not a consent screen per agent.

With Signet, their identity provider signs one decision naming the agent, the person it acts for and your API. Signet honours it. The token it issues lasts an hour at most, works only against the API that decision names, and carries only what was approved. You can revoke any token at once.

An agent that publishes its own metadata can also sign a person in with no registration step, and an organization can require each such agent to be adopted before it signs anyone in.

The agent's OAuth client is registered for Hooli's deploy agent
deploys:readdeploys:writebilling:readmembers:write
Hooli's identity provider decides Deploy agent may call api.piedpiper.example for Ada Chen, read only
Your Signet issues sig_at_9fQk2LwPzR…
deploys:readdeploys:writebilling:readmembers:write
One API, expires in 41 minutes
Limits

Identity-provider decisions are proven against Okta's public Cross-App Access test service (20 Aug 2026), not yet a customer's own tenant. They work on hosted Team and Business instances; a self-hosted build needs enterprise SSO compiled in. The person the agent acts for must already have an account in that organization. Requiring adoption is off by default, and there is no instance-wide block list.

From sign-up to a signed-in user.

Once your Hobby instance is ready, two requests make a user and read the session back. They are the calls your better-auth client sends: on every check in the compatibility profile (better-auth 1.6.23), the client cannot tell Signet apart.

Your first user, from the terminal.

The answers are real, from Signet's engine with Hobby's settings on 28 October 2026, and shortened. Use your instance's address and your own email.

Terminal
curl -c jar.txt -X POST https://yourapp.signetauth.dev/api/auth/sign-up/email \
  -H 'Content-Type: application/json' \
  -d '{"email":"ada@signetauth.com","password":"plum-river-quartz-71","name":"Ada"}'
{"token":"sig_sess_B7V2…","user":{…,"email":"ada@signetauth.com",
 "emailVerified":false,"id":"4HnWJPAM…",…,"name":"Ada",…}}

curl -b jar.txt https://yourapp.signetauth.dev/api/auth/get-session
{"session":{…,"token":"sig_sess_B7V2…",…,"userId":"4HnWJPAM…"},
 "user":{…,"email":"ada@signetauth.com",…}}

Plan and setup refusals say what to do next.

When an instance's plan or setup stops a request, the error names the cause and the fix, in words a person can follow and an agent can act on. A wrong password, an unknown address and a locked account get the same answer, so a refusal does not show which accounts exist. This is what a Hobby instance answers when someone tries to add enterprise SSO.

HTTP 403 from a Hobby instance
{  "code": "PLAN_FORBIDS_SSO",  "message": "Enterprise SSO is not    part of this instance's plan    (hobby). It starts on Team —    https://signetauth.com/pricing."}

Receipts instead of adjectives.

Every Signet instance serves its own certification receipt, with the date each line was recorded. Where we have not measured something, the receipt says so instead of guessing.

Thirteen authentication flows and five authorization flows are driven in a real browser with screenshots. The four the harness skips (passkeys, social sign-in, SSO and Sign in with Ethereum) are named, with the reason. SSO is tested separately, with real identity providers.

A re-run on 17 September 2026 found differences we are still working through, most of them from a deliberate change in where Signet mounts SCIM. The receipt keeps its recorded date until they are settled.

How compatibility is measured

/certificationServed by the instance, with no outside fetch
Compatibility profile
Signet compatibility profile v1, against better-auth 1.6.23Recorded on 22 July 2026.
Certification gap
0On every check in the profile, a client cannot tell Signet and better-auth apart. The profile covers what its checks exercise, and nothing beyond it.
End-to-end acceptance
14 / 14Recorded on 22 July 2026.
Operating envelope
Not publishedNot yet measured under load, so no capacity number is claimed.
Ask our own instance for its receipt
curl -s https://kapable-dev.signetauth.dev/certification.json \
  | jq .certification_gap
{
  "value": "0",
  "provenance": "recorded",
  "as_of": "2026-07-22"
}

Security you can check.

Each line below is something we tested on the real product and recorded. What we do not hold yet is listed too.

Bearer credentials are hashed at rest

Sessions, API keys and OAuth tokens are stored as digests, not as the tokens themselves. Emailed one-time codes and tokens from social sign-in providers are the exceptions.

A leaked token is findable

New credentials carry prefixes such as sig_sess_ and sig_ak_, so GitHub secret scanning, TruffleHog and gitleaks can catch one in a commit.

Resets end every session

By default, a password reset ends every session the person has, in the same database transaction.

Hosted data is encrypted at rest

The database volume, its backups and the nightly dumps. That protects a detached disk or a copied backup. It does not protect against someone who controls the running host.

Erasure is enforced

Erase a person and any access token, code or refresh token they still hold is refused.

Self-hosted builds are traceable

Each licensed build is watermarked to its holder, and the licence is checked offline when it starts.

Not held yet

A third-party audit report or certification, and a third-party penetration test report. We run our own attack suite every night and call it that. What we do not claim lists each one, with its date.

The security page The vendor pack for your security review

Changes, with dates.

Every change a customer would notice is written up and dated the day it lands in the engine.

The full changelog

Connect an enterprise identity provider by name, and test it with one button The sign-in page says when a second step is needed, instead of starting over A person can confirm the sign-in they already have with their passkey A product on another host can offer "Sign in with a passkey" Sessions bound to an organization sign out together The Signet host is monitored, with alert mail before a customer notices

Prices that do not grow with your users.

There is no per-user tier, no overage and no usage meter, so your bill does not move when you win a customer.

Hobby

$0

For a side project, or your first users before anyone asks for SSO.

  • Email and password, passkeys, magic links, codes, two-factor and social sign-in
  • Teams and invites, unlimited users
  • Up to five agent tokens live at a time, each lasting an hour at most
  • One instance per company
Start on Hobby

Team

$299a month

For the quarter your first enterprise customer asks for SSO.

  • Unlimited enterprise SSO connections
  • Unlimited users
  • Machine tokens and always-on agents
  • One production instance, email support
  • 30-day trial, card required, charged when it ends
Start on Team

Business

$999a month

For teams that need a staging instance and a support SLA.

  • Everything in Team
  • Production and staging instances
  • Priority support, with the SLA stated in your contract
  • 30-day trial, card required, charged when it ends
Start on Business

Scale

$15,000a year

For running Signet on your own hardware.

  • A licence per production deployment, on standard terms
  • A build watermarked to you, licence checked offline
  • Air-gapped delivery, source escrow or named support are quoted as Enterprise
Talk to us

Hosted Signet runs in the USA. Canadian companies with a Canadian billing address and a Canadian business number can pay CA$299 and CA$999. Every detail of each plan.

Your next customer will ask about SSO, then about their agents.

Have both answers before their spreadsheet arrives.

Start free Talk to us