What's included
Google OAuth, magic links, email/password, and social login. Session management across devices. Password resets and email verification. API key authentication for public APIs.
CSRF protection, rate limiting, brute force prevention, secure cookie configuration, token expiration, and refresh flows are configured by default.
Role-based access control with organization-level and workspace-level permissions. Custom roles with granular permission gates.
Authentication typically takes 3-6 weeks to build. BuildBase handles it in minutes.
Auth methods
Every authentication method your users expect, configured and ready in minutes.
OAuth 2.0
Sign in with Google, LinkedIn, GitHub, Microsoft, and other providers. Redirect flow, token exchange, and automatic account linking. Enable providers individually per workspace.
Magic Links
Passwordless authentication via email. Users click a link and are signed in. No passwords to store, no credentials to manage.
Social Login
Google, LinkedIn, GitHub, and Microsoft sign-in with a single click. Manages the full OAuth flow including token exchange and account linking. Handles edge cases like email conflicts between providers.
Passkeys
WebAuthn passkey sign-in with platform authenticators. Users register a passkey once and sign in with Face ID, Touch ID, or a hardware key. Works alongside password and social login.
API Tokens
Scoped API tokens for programmatic access. Each token can be named, described, activated, or revoked. Supports integrations, CI/CD pipelines, and third-party access.
Session Management
Token refresh, multi-device support, and configurable expiration. Sessions are backed by Redis for speed and reliability.
Custom Domains
Run authentication on a custom domain. Register domains, verify via DNS, and serve a branded sign-in experience to end users.
Security built in
Every auth endpoint is hardened by default. Encryption, rate limiting, token rotation, and brute force protection are applied automatically across all authentication flows.
- AES-256 encryption at rest
- TLS 1.3 for all traffic in transit
- Rate limiting on auth endpoints
- Secure session cookies with CSRF protection
- Automatic token rotation and expiration
- Brute-force protection on login attempts
- Email verification before activation
- Audit logs for every auth event
Role-based access control
BuildBase includes organization-level roles, workspace-level permissions, and custom roles with granular permission gates. Assign roles once and enforce them across every API endpoint and UI component.
Three users or three thousand — the permission model stays clean. Declare what each role can access. The platform enforces it everywhere.
Minutes
To integrate
Authentication typically takes 3-6 weeks to build. BuildBase is ready in minutes.
Built in
Security defaults
CSRF, rate limiting, token rotation, and brute force protection are configured out of the box.
Unlimited
Auth methods
OAuth, magic links, social login, API tokens — enable any combination from the dashboard.
5-line integration
Install the SDK, wrap your app, and call one hook. OAuth, magic links, sessions, and permissions are included.
import {
useSaaSAuth,
WhenAuthenticated,
WhenUnauthenticated,
} from '@buildbase/sdk/react';
function App() {
const { user, signIn, signOut, openWorkspaceSettings } = useSaaSAuth();
return (
<>
<WhenUnauthenticated>
<button onClick={() => signIn()}>Sign In</button>
</WhenUnauthenticated>
<WhenAuthenticated>
<p>Welcome, {user?.name}</p>
<button onClick={() => openWorkspaceSettings('subscription')}>
Manage Plan
</button>
<button onClick={signOut}>Sign Out</button>
</WhenAuthenticated>
</>
);
}import {
WhenAuthenticated,
WhenUnauthenticated,
WhenPermission,
Permission,
} from '@buildbase/sdk/react';
function Dashboard() {
return (
<>
<WhenUnauthenticated>
<LoginPage />
</WhenUnauthenticated>
<WhenAuthenticated>
<MainApp />
<WhenPermission permission={Permission.WORKSPACE_BILLING_MANAGE}>
<BillingSettings />
</WhenPermission>
</WhenAuthenticated>
</>
);
}Frequently Asked Questions
Do I need to build a login page?
No. BuildBase includes a white-label auth portal with login, register, magic link, email verification, and sign-out pages. It loads your org branding, auth methods, and T&C links dynamically.
Can users sign in with Google, LinkedIn, GitHub, or Microsoft?
Yes. Enable social providers in the admin dashboard. The SDK handles the OAuth flow, token exchange, and account linking.
How do sessions work?
Sessions last 30 days. Permissions refresh every hourly. One hook call — the SDK manages session creation, storage, and refresh.
Is enterprise SSO or SAML supported?
Not yet. Current providers: Email/Password, Google, LinkedIn, GitHub, Microsoft, Magic Link, Passkeys, OAuth 2.0. SAML and OIDC are on the roadmap.
Can I use a custom domain for the auth portal?
Yes. Register custom auth domains with DNS verification and SSL.
How does the SDK handle permissions?
Permissions resolve through 3 tiers: workspace overrides, org settings, then SDK defaults. Owners get all permissions automatically. Use <WhenPermission> for declarative UI gating.