# Signet — machine on-ramp (marketing site)
# https://signetauth.com

Signet is a customer identity and access management (CIAM) engine, written in
Rust, whose data you own outright — for a single developer or an enterprise
moving off an incumbent.
Every user, session, and secret lives in your own PostgreSQL, hosted by the
Signet team or, under an enterprise licence, on your own metal; it needs
nothing from the public internet.
better-auth is the drop-in proof, not the identity: Signet speaks the better-auth
wire, so existing better-auth clients integrate unchanged — but the product is
ownership of your authentication, whoever your users are.

The pitch, in three parts:
1. Own it     — your users, your data, your Postgres. Everything in your own database,
                sealed / air-gap capable, an /admin operator surface you control,
                no vendor lock-in, a clean migration path off the incumbents; an
                enterprise licence takes the same binary onto your own metal.
2. Pay less   — Free to 50,000 MAU, then $19/mo plus $0.01/MAU over 50k
                (ratified 2026-07-21) — priced under the hosted incumbents,
                with no per-user ransom at renewal.
3. Drop-in    — your better-auth client already speaks Signet (certification gap 0).

Commercial posture: data residency by construction, no per-user renewal ransom,
and a leave-without-us guarantee (an enterprise licence takes the same binary
on-prem). Signet makes NO SLA
and claims NO third-party compliance certification — those are your decisions on
infrastructure you control.

This is the marketing site. The PRODUCT itself is one binary; every deployed
instance serves its own certified API, operator dashboard, embedded docs, and
compatibility receipt.

## Certified facts (recorded, not marketing)
Compatibility profile: better-auth 1.6.23
Certification gap: 0
Scope of that gap: The sweep replays better-auth's own test suite — 29 files — against better-auth and against Signet, and compares the results. Gap 0 means every assertion that passes against better-auth also passes against Signet, byte for byte. It is not a claim that every better-auth route is implemented: the profile is scoped to what that suite exercises here, and anything it does not exercise sits outside it. Ask about a specific route and we will tell you plainly whether it is in the profile.
Conformance sweep: 280 / 280 (better-auth reference ceiling matched)
End-to-end acceptance: 14 / 14
Profile version: Signet compatibility profile v1
Recorded: 2026-07-25
Engine shape: one Rust binary, one process, one PostgreSQL — no Node runtime, no
sidecar fleet, nothing phones home; sealed / air-gap capable.
Operating envelope: not published — not yet measured under load, so no capacity number is claimed.
Support: self-serve documentation plus best-effort support. No SLA is offered or implied.

## Pricing note
Signet launch pricing is ratified (decision of record, 2026-07-21):
Free to 50,000 MAU, then $19/mo plus $0.01/MAU over 50k. The
competitor figures (Clerk, Auth0, Stytch) are the vendors' own published
prices, each cited with a source URL and retrieval date on /pricing.

## Pages on this site
https://signetauth.com/              Home — stop renting your front door; the charter in three articles.
https://signetauth.com/product       The surfaces one Signet instance serves, the escape hatch, provisioning.
https://signetauth.com/certification The honest receipt — differential conformance, end-to-end acceptance, gap, and recording date.
https://signetauth.com/quickstart    Developer on-ramp — five framework quickstarts (Next.js, React, React Router v7, Node/Express, plain JS) using the stock better-auth client pointed at /api/auth.
https://signetauth.com/configuration Configuration is the dashboard — every Clerk hosted-dashboard setting mapped to the real signet.toml key that does the same job. Config lives in your git repo, not a vendor console.
https://signetauth.com/pricing       Ratified pricing — Free to 50,000 MAU, then $19/mo + $0.01/MAU over 50k — with a cited comparison against the incumbents.
https://signetauth.com/early-access  Request early access (intake form -> POST /api/intake).

## For a real integration
A deployed Signet instance speaks the better-auth wire under /api/auth on its own
origin, and serves its own /llms.txt enumerating that instance's certified
endpoints. Integrate against the instance, not this marketing site.