Machine-to-machine authentication
Secure service-to-service calls with the standard OAuth 2.0 client_credentials grant: register a machine client, request a token, and call your API with a signed JWT you can validate anywhere. No user, no browser, no identity plumbing to build.
curl -X POST https://your-app.auth.faable.link/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID \
-d client_secret=$CLIENT_SECRET \
-d audience=https://api.your-app.com
# → { "access_token": "eyJ…", "token_type": "Bearer",
# "expires_in": 3600 }Service-to-service auth in three steps
Register a machine client
Create a Machine-to-Machine client in the dashboard and get a client_id and client_secret. One client per service, cron job or agent — rotate or revoke each secret independently.
Request a token
POST the credentials to your tenant's /oauth/token endpoint with grant_type=client_credentials and the audience of the API you are calling. You get back a short-lived, signed JWT access token.
Call your API and validate
Send the token as a Bearer header. Your API validates the signature against the tenant's public JWKS — no shared secrets between services, no calls back to Faable on the hot path.
Intuitive auth, designed for coders
Everything you need to authenticate and authorize users — without wrestling with identity infrastructure.
OAuth 2.0 & OIDC
Industry standards built in, no spec-reading required.
Social Login
Google, GitHub, Microsoft and more with a single toggle.
Framework Quickstarts
Drop-in flows for Next.js, React Native and more.
Multi-tenant by Design
Isolate orgs, teams and users without extra plumbing.
Machine-to-Machine
Issue M2M tokens for service-to-service auth.
Actions & Webhooks
Run your own code inside the login flow, or react to it.
Single Sign-On
One identity across all of your apps and services.
Passwordless
Magic links and email codes for frictionless sign-in.
Hosted Login Pages
Sign-in, sign-up, reset, MFA and passkey screens — hosted and branded.
MFA & Passkeys
Authenticator apps, security keys, Touch ID and Face ID.
Auth from the CLI
Query, suspend and audit users, and ship Actions from a file.
Audit Logs
Every login, token grant and admin change, queryable.
Pricing, in full
Auth is included in every plan, starting on Free. One subscription covers Faable Auth and Faable Deploy — no per-feature add-ons.
Everything you need to launch — no credit card.
- Hosted login, users and sessions
- Up to 15,000 monthly active users
- Email & password and social login
- RBAC and teams
- Import users with their password hashes
- 100 M2M tokens / month
For the first product in production.
- Unlimited monthly active users
- Two-step verification (MFA) for your users
- Passwordless magic link & code login
- Actions and custom login flows
- Webhooks
- 20 recovery SMS / month, then €0.20 / SMS
- 100 M2M tokens / month, then €2.25 per 1,000
For products at scale — no per-user pricing.
- Custom domain for your login
- Biometric login with Touch ID and Face ID
- Audit logs
- Multiple auth accounts
- Everything in Hobby
No credit card required to start · Full plan comparison · Data processing & privacy
Frequently asked questions
The essentials about Faable Auth, in plain language.
Is there a free tier?
Yes. You can start free with no credit card — hosted login, email and password, social login and RBAC for up to 15,000 monthly active users. Hobby (€15/month) removes the MAU limit and adds MFA, passwordless and Actions; Pro (€99/month) adds a custom login domain, passkey sign-in and audit logs. See the Auth pricing page for the full comparison.
How do I add passwordless (magic link) login?
Create a client with the @faable/auth-js SDK and call signInWithPasswordless({ email, type: 'link' }) for a magic link, or type: 'code' for a one-time email code. Faable hosts the login pages and handles delivery — you don't store passwords or build reset flows.
Do I have to build the login screens?
No. Faable Auth hosts every screen on your auth domain — sign-in, sign-up, password reset, two-step verification, passkey enrolment and a security page where users manage their own factors. Your app redirects to /authorize and gets the user back signed in. You choose the logo, which methods appear and in what order, per app; on Pro the pages run on your own domain.
Can I manage users from the terminal?
Yes. The faable CLI has a full auth command: list and filter users, see their linked identities and last login, suspend or reinstate them in bulk from a pipe, create OAuth clients, ship Actions from a file, and read the audit log — all with --json output for scripting.
How do I do machine-to-machine (M2M) authentication?
Register a Machine-to-Machine client in the Faable Dashboard and use the OAuth 2.0 client_credentials grant: POST your client_id and client_secret to the token endpoint and receive a signed JWT access token scoped to your API's audience. Ideal for backends, cron jobs and agents with no human in the loop. Every plan includes 100 M2M tokens a month; on Hobby and Pro, more are €2.25 per 1,000.
Where is my users' data hosted?
100% in Europe, under European law and with full GDPR compliance. Faable Auth gives you digital sovereignty: identity data stays in the EU.
Can I migrate from Auth0, Clerk or Keycloak?
Yes, and your users keep their passwords. Faable Auth imports the bcrypt, scrypt, PBKDF2 and Argon2id hashes that Auth0, Clerk, Firebase, Supabase and Keycloak export, on every plan, so nobody has to reset. It implements the same OAuth 2.0 and OIDC standards, with step-by-step migration guides for Auth0, Clerk and Keycloak, so you can switch without rebuilding your integration.
Which standards does Faable Auth implement?
OAuth 2.0 and OpenID Connect (OIDC), with authorization-code + PKCE, client credentials, device code, refresh-token and token-exchange flows, plus social login, MFA/2FA, SSO and multi-tenant organizations out of the box.
Add auth in minutes
Create a tenant, drop in the SDK, and ship passwordless, social and M2M auth — hosted in the EU, GDPR by default. Free to start, no credit card required.