Enterprise auth, embedded in your database.
Branded login, social auth, SAML SSO, and fine-grained permissions — one NuGet package that runs in your app and lives in your database.
Everything between “Sign in” and a row of data
Three products' worth of surface area, one package. Each piece is live the moment you map the routes.
Sign in to YourProduct
Hosted login, your brand
Server-rendered signup, login, and logout on your domain — logo, colors, and providers configured from the dashboard.
Ship the login pageEnterprise SSO in an afternoon
SAML and OIDC per organization. Hand your customer the ACS URL, import their metadata, and home realm discovery routes by email domain.
See the SSO flowPermissions that cascade
Model your real hierarchy, grant a role at any node, and access inherits downward. Lists are pages of your EF Core query, checked in SQL.
Explore FGAAuthorization isn’t an API call.
It’s a WHERE clause.
Other stacks fetch rows and then ask a policy service about each one. SqlOS checks access inside your query on SQL Server or PostgreSQL and reads only the page the caller can see — about a page of work for any caller.
var page = await db.Projects
.OrderBy(p => p.Name)
.ToPageAsync(user.Id, "projects.read", pageSize: 20, cursor); // about a page of work- per page at 1.2M rows
- 3.47ms
- per page at 1.2M rows
- point checks, D=10
- <1.5ms
- point checks, D=10
- bounded, N-free
- O(k·D)
- bounded, N-free
And a control plane you don’t have to build
The dashboard ships in the package — orgs, users, sessions, providers, grants, audit, and a live access tester at /sqlos.
Your auth server is one package away
Install it, map the routes, run the Todo sample. Everything on this page is in the box.