(01)
OIDC Social Auth
Native support for GitHub, Google, Microsoft, Discord, LinkedIn, Apple, Slack, and 4 more. Toggle providers per tenant. Claims are mapped and standardized automatically.
(Verne Gate · Auth-as-a-Service)
Enterprise-Grade Authentication for B2B SaaS Hosted Ory Kratos — OIDC, MFA, Passwordless & Webhooks
Stop building login forms. Verne Gate provides a complete identity control plane with 11 OIDC providers, Passwordless OTP, MFA, and native webhooks. You get the same Ory Kratos you could run yourself, without the Docker, the Helm chart, the upgrades or the admin UI you would have to build.
curl -X PATCH https://api.vernesoft.com/v1/gate/identities/id_12345/metadata \
-H "Authorization: Bearer vrn_gate_•••" \
-d '{"role":"admin","subscription_tier":"pro"}'(The DIY Auth Trap)
Why Writing Your Own Auth is a Security Liability
Implementing a simple email/password login is deceptive. Scaling to social logins, managing secure password recovery, enforcing MFA, and handling session revocation across distributed systems requires a dedicated engineering team.
In-House Auth
- ✕ Managing 11 different OAuth app credentials and claim mapping logic.
- ✕ Building complex UI flows for MFA recovery codes and email verification.
- ✕ Storing custom user data in disjointed databases leading to sync issues.
- ✕ Polling the database to check if a user revoked a session.
- ✕ Or self-hosting Keycloak or Ory Kratos: Docker, Helm, version upgrades, and an admin UI you still write yourself.
Verne Software Gate
- ✓ 11 OIDC providers ready to toggle on/off per tenant.
- ✓ Managed flows for settings, recovery, and verification via API.
- ✓ Deeply integrated custom metadata store (JSON).
- ✓ Real-time HMAC-signed webhooks for login and state changes.
- ✓ The same open-source Ory Kratos, run for you, with a dashboard and API keys on day one.
(Core Features)
An Identity Provider Engineered for Flexibility
(02)
Adaptive Security (MFA & Passwordless)
Enable TOTP with backup codes, or go fully passwordless with secure OTP email codes with a 15-minute lifespan. Configurable per tenant.
(03)
Complete Session Management
Query active sessions by device, IP, and user agent. Revoke specific sessions or all sessions for a compromised identity with a single API call.
(04)
Custom Identity Metadata
Attach proprietary JSON metadata to users. Perform atomic merge-updates without overwriting protected tenant data. Perfect for RBAC payloads.
(05)
Real-Time Webhooks
Get notified instantly on identity.created, identity.login, or identity.deleted. Built-in 3-attempt exponential backoff and HMAC-SHA256 signature verification.
(06)
Managed Auth Flows
Secure, two-phase state-machine flows for Password Recovery, Settings updates, and Email Verification — all managed and auditable.
(Nautilus Ecosystem)
The Core of the Nautilus Ecosystem
Gate is the security perimeter for your entire architecture. Authenticate users via Gate, trigger scheduled billing runs via Clockwork, and securely dispatch events to your clients via Relay. One API, one dashboard, and strict tenant isolation across all services. All of it runs on our own servers in France.
Gate (Auth)Core API (Logic)Clockwork (Cron)Relay (Webhooks)
(Developer Experience)
Extend Identities with Custom Metadata
Attach B2B roles, subscription tiers, or feature flags directly to the auth identity, with JSON Patch operations applied atomically.
curl -X PATCH https://api.vernesoft.com/v1/gate/identities/id_12345 \
-H "Authorization: Bearer $VERNE_GATE_KEY" \
-H "Content-Type: application/json" \
-d '[
{ "op": "replace", "path": "/traits/custom_data/role", "value": "admin" },
{ "op": "add", "path": "/traits/custom_data/beta_access", "value": true }
]'(FAQ)
Frequently Asked Questions
How are custom OIDC claims handled?
Gate uses internal jsonnet mappers for all 11 supported providers. It automatically extracts, normalizes, and maps claims so your application receives a predictable, standardized user schema.
How do Gate webhooks ensure security?
Every webhook payload is signed using HMAC-SHA256. The signature is passed in the X-Verne-Signature header, allowing your backend to mathematically verify the payload originated from Verne Gate.
Can I force a user to log out of all devices?
Yes. The Session Management API allows you to send a DELETE request to /v1/gate/identities//sessions, instantly invalidating all active sessions across all devices and browsers.
Are users isolated between my different tenants?
Absolutely. Strict tenant isolation is enforced at the in-memory layer. Custom metadata includes protected tenant IDs that cannot be overwritten by client requests.
What is Gate actually running?
Ory Kratos, the open-source identity server — one hardened deployment with strict tenant isolation, and the flows, admin UI and API keys layered on top. The engine is open source, so if your requirements change, the same software runs on your own infrastructure.
Where is identity data stored?
On our own servers in France. Identities, sessions and custom metadata stay in the EU, and nothing is replicated outside it.
(Get Started Today)
Stop Building Login Screens
Secure your B2B SaaS with enterprise-grade auth, MFA, and webhooks in a fraction of the time.
What you keep
Auth is where lock-in usually starts, because whoever owns the user record ends up shaping the data model around it. Gate does not ask for that. Identities live here; your users, orders and everything else stay in the Postgres, MySQL or Mongo you already run. There is no schema of ours for your tables to fit and nothing to migrate into.
Underneath is Ory Kratos, open source and unmodified. We run the cluster, the upgrades and the on-call, and we keep that deployment deliberately boring — but the engine is one you could run yourself. An auth vendor you can leave is a different proposition from one you cannot, which is why we name the engine rather than hide it.
It runs on our own servers in France, which is the first question most European buyers ask. The free tier is 3,000 requests a month with every engine included, so an afternoon is enough to find out whether Gate fits the stack you already have.