Hosted, passwordless sign-in for your website or app. People sign in with a one-time code by
email or text message, or with their Microsoft account,
and your site gets a signed ID token through standard OpenID Connect.
The user reaches a secure area of your site, which sends them to a sign-in page with your site's name.
yourapp.com • secure
Verification required
We’ll send a one-time code to confirm it’s really you.
mail
Code Delivered
AuthTo.it sends a secure 6-digit code by email or SMS.
Code:
4
9
1
0
3
7
Expires in 10 minutes.
pin
User Enters Code
The user types the code on the sign-in page. A code works once, with five tries.
verified
Access Granted
They return to your site with a signed ID token. Next time, a signed-in visitor comes straight back without a code.
check
Identity verified.
What you get
key
Standard OpenID Connect
Point any OpenID Connect library at one discovery URL. Authorization code flow with PKCE, RS256-signed
tokens, published keys, userinfo, refresh tokens and sign-out.
group
Your People, Your Rules
Each site has its own people. Make a site invite-only for staff areas, or open to anyone who proves their
email or phone. Give people a name and a role, or suspend them.
palette
Your Branding
The sign-in page shows your site's name, with your support email and links to your privacy policy
and terms, and your logo and colours on Starter and up. Codes arrive as "Your Site via authto.it".
shield_lock
No Passwords to Store
Codes expire in ten minutes and are rate-limited. Refresh tokens rotate on every use, and a reused one
ends the sign-in. Texts are sent only after the number agrees to receive them.
account_circle
Sign in with Microsoft
Add a Continue with Microsoft button to any site, on every plan. Personal
Microsoft accounts and work or school accounts both work. The address is treated like one proven with a code,
so an invite-only site still checks its People list.
smart_toy
API and AI Assistants
Manage sites and people from your own code with the management API, or ask an AI assistant such as Claude to do it
through MCP. Keys carry only the scopes you give them, and client secrets are never handed to AI tools.
Plans
Join the waitlist and we will email you when sign-ups open. Plans can then be started free and changed any time in your ScaledApps organization. Prices in US dollars, plus tax where it applies.
Free
$0
Sites1
People signing in a month1,000
Email codes✓
Text-message codes—
Your logo and colours—
Sign in with Microsoft✓
API requests a minute60
AI assistants (MCP)✓
Starter
$9/month
or $90/year — two months free
Sites3
People signing in a month5,000
Email codes✓
Text-message codes250 a month
Your logo and colours✓
Sign in with Microsoft✓
API requests a minute120
AI assistants (MCP)✓
Pro
$39/month
or $390/year — two months free
Sites10
People signing in a month50,000
Email codes✓
Text-message codes1,000 a month
Your logo and colours✓
Sign in with Microsoft✓
API requests a minute300
AI assistants (MCP)✓
Business
$99/month
or $990/year — two months free
SitesUnlimited
People signing in a month100,000
Email codes✓
Text-message codes5,000 a month
Your logo and colours✓
Sign in with Microsoft✓
API requests a minute600
AI assistants (MCP)✓
Past a limit, nobody is turned away: people beyond the monthly number can still sign in,
and once the month's text-message codes are used, people who sign in by phone still get theirs while new numbers use email until the next month. Details
