An OAuth 2.0 API for your app
Standard endpoints, not a framework: authorization code with PKCE, client credentials for your services, refresh tokens and a signed JWT you can validate anywhere. Drop in @faable/auth-js and skip the identity plumbing.
curl -X POST https://your-app.auth.faable.link/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID \
-d client_secret=$CLIENT_SECRET \
-d audience=https://api.your-app.com
# → { "access_token": "eyJ…", "token_type": "Bearer",
# "expires_in": 3600 }Magic links & email codes, without the plumbing
Let users sign in with a magic link or a one-time email code — no passwords to store, no reset flows to build, no forms to maintain. Two lines with the SDK and you're live.
- Magic link or 6-digit email code
- Hosted, themeable login pages
- Drop-in quickstarts for Next.js, React & more
import { createClient } from "@faable/auth-js";
const auth = createClient({
domain: "your-app.auth.faable.link",
clientId: "<client_id>",
redirectUri: window.location.origin,
});
// Send a magic link (or type: "code" for an OTP)
await auth.signInWithPasswordless({
email: "ada@acme.com",
type: "link",
});Service-to-service auth with client credentials
Issue OAuth 2.0 client-credentials tokens for your backends, cron jobs and agents. Register an M2M client in the dashboard, request a signed JWT, and call your protected APIs — no human in the loop.
- Standard client_credentials grant
- Signed JWT access tokens, scoped per audience
- One client per service, revocable anytime
curl -X POST https://your-app.auth.faable.link/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CLIENT_ID \
-d client_secret=$CLIENT_SECRET \
-d audience=https://api.your-app.com
# → { "access_token": "eyJ…", "token_type": "Bearer",
# "expires_in": 3600 }Intuitive auth, designed for coders
Everything you need to authenticate and authorize users — without wrestling with identity infrastructure.
OAuth 2.0 & OIDC
Industry standards built in, no spec-reading required.
Social Login
Google, GitHub, Microsoft and more with a single toggle.
Framework Quickstarts
Drop-in flows for Next.js, React Native and more.
Multi-tenant by Design
Isolate orgs, teams and users without extra plumbing.
Machine-to-Machine
Issue M2M tokens for service-to-service auth.
Actions & Webhooks
Run your own code inside the login flow, or react to it.
Single Sign-On
One identity across all of your apps and services.
Passwordless
Magic links and email codes for frictionless sign-in.
Hosted Login Pages
Sign-in, sign-up, reset, MFA and passkey screens — hosted and branded.
MFA & Passkeys
Authenticator apps, security keys, Touch ID and Face ID.
Auth from the CLI
Query, suspend and audit users, and ship Actions from a file.
Audit Logs
Every login, token grant and admin change, queryable.
Works with React — and every framework you ship
Drop-in quickstarts for React and the rest of the modern stack. Copy-paste a guide to wire up login, sessions and protected routes in minutes — then secure the API behind them with the same tokens.
Pricing, in full
Auth is included in every plan, starting on Free. One subscription covers Faable Auth and Faable Deploy — no per-feature add-ons.
Everything you need to launch — no credit card.
- Hosted login, users and sessions
- Up to 15,000 monthly active users
- Email & password and social login
- RBAC and teams
- Import users with their password hashes
- 100 M2M tokens / month
For the first product in production.
- Unlimited monthly active users
- Two-step verification (MFA) for your users
- Passwordless magic link & code login
- Actions and custom login flows
- Webhooks
- 20 recovery SMS / month, then €0.20 / SMS
- 100 M2M tokens / month, then €2.25 per 1,000
For products at scale — no per-user pricing.
- Custom domain for your login
- Biometric login with Touch ID and Face ID
- Audit logs
- Multiple auth accounts
- Everything in Hobby
No credit card required to start · Full plan comparison · Data processing & privacy
Frequently asked questions
The essentials about Faable Auth, in plain language.
Is there a free tier?
Yes. You can start free with no credit card — hosted login, email and password, social login and RBAC for up to 15,000 monthly active users. Hobby (€15/month) removes the MAU limit and adds MFA, passwordless and Actions; Pro (€99/month) adds a custom login domain, passkey sign-in and audit logs. See the Auth pricing page for the full comparison.
How do I add passwordless (magic link) login?
Create a client with the @faable/auth-js SDK and call signInWithPasswordless({ email, type: 'link' }) for a magic link, or type: 'code' for a one-time email code. Faable hosts the login pages and handles delivery — you don't store passwords or build reset flows.
Do I have to build the login screens?
No. Faable Auth hosts every screen on your auth domain — sign-in, sign-up, password reset, two-step verification, passkey enrolment and a security page where users manage their own factors. Your app redirects to /authorize and gets the user back signed in. You choose the logo, which methods appear and in what order, per app; on Pro the pages run on your own domain.
Can I manage users from the terminal?
Yes. The faable CLI has a full auth command: list and filter users, see their linked identities and last login, suspend or reinstate them in bulk from a pipe, create OAuth clients, ship Actions from a file, and read the audit log — all with --json output for scripting.
How do I do machine-to-machine (M2M) authentication?
Register a Machine-to-Machine client in the Faable Dashboard and use the OAuth 2.0 client_credentials grant: POST your client_id and client_secret to the token endpoint and receive a signed JWT access token scoped to your API's audience. Ideal for backends, cron jobs and agents with no human in the loop. Every plan includes 100 M2M tokens a month; on Hobby and Pro, more are €2.25 per 1,000.
Where is my users' data hosted?
100% in Europe, under European law and with full GDPR compliance. Faable Auth gives you digital sovereignty: identity data stays in the EU.
Can I migrate from Auth0, Clerk or Keycloak?
Yes, and your users keep their passwords. Faable Auth imports the bcrypt, scrypt, PBKDF2 and Argon2id hashes that Auth0, Clerk, Firebase, Supabase and Keycloak export, on every plan, so nobody has to reset. It implements the same OAuth 2.0 and OIDC standards, with step-by-step migration guides for Auth0, Clerk and Keycloak, so you can switch without rebuilding your integration.
Which standards does Faable Auth implement?
OAuth 2.0 and OpenID Connect (OIDC), with authorization-code + PKCE, client credentials, device code, refresh-token and token-exchange flows, plus social login, MFA/2FA, SSO and multi-tenant organizations out of the box.
Add auth in minutes
Create a tenant, drop in the SDK, and ship passwordless, social and M2M auth — hosted in the EU, GDPR by default. Free to start, no credit card required.