(Nautilus · Sign-in and users)
Registration, login, password recovery, email verification and two-factor, as API calls. You draw the screens; Nautilus runs what sits behind them: sessions, ten login providers, signed webhooks and a dashboard for your users. It is the Ory Kratos you could host yourself, minus the Docker setup, the database and the upgrades.
curl -X PATCH https://api.vernesoft.com/v1/gate/identities/id_12345/metadata \
-H "Authorization: Bearer vrn_gate_•••" \
-H "Content-Type: application/json" \
-d '{"role":"admin","subscription_tier":"pro"}'(Build it or host it)
Email and password looks like a day of work. Then come recovery by email, verification, a second factor, Google and GitHub login, and a way to end a session you already issued. Writing all that is one cost. Hosting a general identity server such as Keycloak is another: the service, its database, the upgrades, and someone on your team who understands it when it breaks.
Build it or self-host it
With Nautilus
(Core Features)
(01)
GitHub, Google, GitLab, Microsoft, Discord, Facebook, LinkedIn, Slack, Twitch and Spotify. Switch each on per account; Nautilus holds the OAuth apps, so you register nothing with the providers. Claims come back mapped to one user shape.
(02)
Authenticator-app codes with backup codes, switched on per account. When you require them, the gateway refuses a session that skipped the second step. Or drop the password: a one-time code by email, valid for 15 minutes.
(03)
List a user's active sessions with the IP address and user agent of each device, when Kratos could detect them. End one session, or every session of an identity, with a single call.
(04)
Keep a plan name, a company or an onboarding flag on the user. A PATCH merges what you send and leaves the rest alone. The user can read it, so no secrets, and Nautilus does not enforce what you put there.
(05)
Sign-ups, logins, password changes, email verification, deactivation and deletion go to your endpoint, signed with the Svix scheme. Failed deliveries get up to eight attempts over about 28 hours, and every attempt is logged and can be resent from the dashboard.
(06)
Password recovery, email verification and settings changes run as short API flows: start one, submit the code or the new value. You render the form; Nautilus sends the email and checks the answer.
(One Product)
Webhooks, cron jobs and Telegram sign-in sit behind the same account and dashboard. In practice that means sign-in events reach your server through the same signed delivery as any other webhook, and each API key is scoped to one task, so the key your login service holds cannot schedule jobs or send webhooks.
(Developer Experience)
The tabs show the same request in curl and in the Node, Python, PHP and Rust SDKs. The tenant comes from the API key, so you never pass an account id.
curl -X PATCH https://api.vernesoft.com/v1/gate/identities/id_12345 \
-H "Authorization: Bearer $VERNE_GATE_KEY" \
-H "Content-Type: application/json" \
-d '[
{ "op": "replace", "path": "/traits/locale", "value": "fr" }
]'(FAQ)
No. Keycloak is a general identity server with SAML, LDAP federation, themeable login pages and an admin console. Nautilus does one narrower job: sign-in and user accounts for the customers of a SaaS product, behind an HTTP API with no screens of its own. If you need SAML or single sign-on for enterprise customers, keep Keycloak. If what you run it for is password login, Google and GitHub, recovery and two-factor, this is the part you can stop hosting. Organizations, roles and members are available through the API; the dashboard has no screen for them yet, and roles are not carried in tokens, so your backend reads them from the API.
Yes, the screens. Nautilus returns each step as an API response and your code submits what the user typed, so the forms look like the rest of your product. What you stop building is everything behind them: password storage, recovery and verification emails, sessions, provider logins. If you want a hosted login page you can theme, Keycloak has one and this does not.
Every delivery carries svix-id, svix-timestamp and svix-signature headers: an HMAC-SHA256 signature over the id, the timestamp and the raw body. Check it with the official open-source Svix library, which exists for Node, Python, Go, Rust, PHP, Java, Ruby, C# and Kotlin, rather than writing the check yourself. Failed deliveries are retried and can be resent from the dashboard.
3,000 requests a month are free, no card. Creating, reading, updating and deleting users count against that; sign-in, registration and recovery flows do not. Starter is €19 for 50,000 requests, Pro €79 for 300,000, and both can add packs of 10,000 for €3. The free plan has no packs. The current list is on the pricing page.
Ory Kratos, the open-source identity server, as one shared deployment for all accounts. The dashboard, the API keys, the webhooks and the check that keeps one account's users away from another's are ours, on top. The trade-off of sharing it: the user schema is fixed to an email, a locale and your JSON field, and you cannot change Kratos's own configuration. The engine is open, so if you outgrow that, the same software runs on your own servers.
In databases on our own servers in France, at OVHcloud: identities, sessions and your custom metadata.
(Get Started Today)
Registration, login, recovery and two-factor for your customers, from one HTTP API. Create an account and the first 3,000 requests every month are free.
What you keep
Auth is where lock-in usually starts, because whoever owns the user record ends up shaping the data model around it. Nautilus does not ask for that. Who can sign in lives here; your customers' records, orders and everything else stay in the Postgres, MySQL or Mongo you already run. There is no schema of ours for your tables to fit and nothing to migrate into.
Underneath is Ory Kratos, open source and unmodified. We run the server and the upgrades, and we keep that deployment deliberately boring, but the engine is one you could run yourself. An auth vendor you can leave is a different proposition from one you cannot, which is why we name the engine rather than hide it.
It runs on our own servers in France, which is the first question many European buyers ask. The free plan is 3,000 requests a month, and sign-in, registration and recovery flows do not count against it, so an afternoon is enough to find out whether this fits the stack you already have.