Own it.
Your users, your data, your PostgreSQL — sealed and air-gap capable, behind an /admin surface you control. An enterprise licence puts the same binary on your own metal, and your auth keeps running without us.
Customer identity you own outright
Stop renting your front door.
Every sign-in you serve passes through a vendor who meters the door and raises the rent at renewal. Signet is a complete auth engine — and every user, session, and secret lives in your PostgreSQL, hosted by us or, under an enterprise licence, on your metal.
Your better-auth client already speaks Signet. Point baseURL at your instance — done.
Conformance280/280
Gap0
Acceptance14/14
better-auth1.6.23
$ node conformance/scripts/ts-client-e2e.mjs
- ▸ signUp.email returns the userPASS
- ▸ getSession sees the signed-up userPASS
- ▸ updateUser succeedsPASS
- ▸ user update is visible on the sessionPASS
- ▸ listSessions returns the active sessionPASS
- ▸ organization.create returns the orgPASS
- ▸ organization.list contains itPASS
- ▸ getFullOrganization shows creator as ownerPASS
- ▸ twoFactor.enable returns TOTP + backup codesPASS
- ▸ changePassword succeedsPASS
- ▸ getSession is null after signOutPASS
- ▸ signIn.email accepts the rotated passwordPASS
- ▸ wrong password returns INVALID_EMAIL_OR_PASSWORDPASS
- ▸ session is live again after signInPASS
END-TO-END 14/14 · CONFORMANCE 280/280 · GAP 0 · receipt → /certification
Certified
Gap 0
2026-07-25
Gap 0
2026-07-25
280/280 is better-auth’s own test suite, run twice — once against the better-auth reference implementation, once against Signet — and diffed. Signet matches the reference on every test the reference passes; the gap is the count where the reference passes and Signet does not. That gap is 0. The sweep replays better-auth's own test suite — 29 files — against better-auth and against Signet, and compares the results. Gap 0 means every assertion that passes against better-auth also passes against Signet, byte for byte. It is not a claim that every better-auth route is implemented: the profile is scoped to what that suite exercises here, and anything it does not exercise sits outside it. Ask about a specific route and we will tell you plainly whether it is in the profile. The run above is the end-to-end acceptance on top of it: better-auth’s unmodified client driving real sign-up, session, org, and 2FA flows. Verify it yourself — every deployed instance serves its receipt at /certification.
280/280 CONFORMANCE SWEEP·GAP 0·14/14 ACCEPTANCE·CERTIFIED AGAINST BETTER-AUTH 1.6.23·ONE RUST BINARY, NO SIDECAR FLEET·YOUR POSTGRESQL IS THE SOURCE OF TRUTH·NOTHING PHONES HOME·FREE TO 50,000 MAU·
Exhibit A — the per-user tax
Your sign-in makes someone else money.
Hosted auth is priced by the user, so the vendor’s revenue grows with your success — not their costs. Whoever holds your credentials holds leverage: a pricing change, an acquisition, a deprecated plan, and your login becomes someone else’s negotiating position.
Bars plot the vendor’s own published figures — Auth0 B2C Essentials, retrieved 2026-07-21, auth0.com/pricing. We plot nothing they haven’t published.
The charter, in three articles
Pay less.
Free to 50,000 MAU, then $19/mo plus $0.01/MAU over 50k — ratified 2026-07-21. Cited and dated against the vendors’ own figures below.
Drop in.
Signet speaks the better-auth HTTP wire, certified against better-auth 1.6.23 with gap 0. Existing clients integrate unchanged — the wire is the contract. The migration story is one changed URL.
Footprint — what one instance needs
ONEPROCESS
The whole engine is a single Rust executable on a single host, talking to your PostgreSQL and to nothing else. No Node runtime, no sidecar fleet, nothing phoning home. Every setting lives in signet.toml in your own repository — there is no hosted console holding your configuration.
bun add better-auth — your client is the stock better-auth package
Deployment manifest
Requires
- ■one hosta single process, wherever you run it
- ■PostgreSQLyour users, sessions and secrets
- ■signet.tomlin your repository, not a vendor console
Does not require
- ✕a Node runtimethe certified wire is compiled in
- ✕a sidecar fleetone binary; nothing runs beside it
- ✕a call homenothing phones home, ever
- ✕the public internetsealed and air-gap capable
Schedule A — what one instance serves
One binary. Five surfaces.
/api/auth/*The certified better-auth wire — conformance 280 / 280 with gap 0; separately, end-to-end acceptance 14 / 14.certified
/adminOperator dashboard — users, session revoke and ban, events and audit export. Zero-JS, server-rendered, CSRF-protected.yours
/docsQuickstart and generated config reference, embedded in the binary — the same at 2am on an air-gapped host.embedded
/certificationThe compatibility receipt, rendered from one source as HTML and JSON so the two can never drift.verifiable
your PostgreSQLUsers, sessions, and secrets in your own database. One binary, one database; nothing phones home.source of truth
Hosted instance→Your metal→Sealed / air-gapped
The escape hatch: same binary at every step, zero client-code changes — on your own metal under an enterprise licence. Every hosted vendor is a one-way door. This one swings both ways.
Pricing — ratified 2026-07-21
Three numbers. Slide to check.
1k50k — free line500k
- base
- $19.00
- usage over 50,000 × $0.01
- $700.00
- Your Signet bill
- $719.00/mo
Formula is the whole price list: Free to 50,000 MAU · $19/mo · $0.01/MAU over 50k. No per-feature pricing exists.
For comparison — vendors’ own published figures
Auth0 B2C Essentials · 1,000 users$70/mo
Auth0 · 10,000 users~$700/mo
Auth0 · 50,000 users~$3,500/mo
Clerk · base$25/mo
Clerk · per MAU over cap$0.02
Published prices, retrieved 2026-07-21 — auth0.com/pricing, clerk.com/pricing. We plot nothing they haven’t published; no interpolation.Self-host / enterprise: same binary, your terms → contact us
Own your auth. Prove it works. Pay $19.
Run the real certified engine. Free to 50,000 MAU. Founding terms lock in for early adopters. And if you ever want to leave — it’s your database. Take it.