Production-ready authentication
Authentication typically takes 3-6 weeks to build. BuildBase ships OAuth, magic links, session management, password resets, email verification, and API tokens - ready in minutes.
Sign in to Acme
Your app is an organization in BuildBase. Your users sign in and work inside workspaces - one per team or customer.
You set up
In the console and the SDK
- Which sign-in methods to offer - Google, GitHub, magic links, passkeys and more
- A sign-in page, hosted for you or built into your app
- Your own domain for sign-in, if you want one
Your users get
Inside their workspace
- Sign-in the way they prefer, including Face ID or Touch ID
- A list of their devices, and sign-out on any one or all of them
- Sign-out that really ends the session
Auth methods
Every authentication method your users expect, configured and ready in minutes.
OAuth 2.0
Sign in with Google, LinkedIn, GitHub, Microsoft, and other providers. Redirect flow, token exchange, and automatic account linking. Enable each provider for your app in the console.
Magic Links
Passwordless authentication via email. Users click a link and are signed in. No passwords to store, no credentials to manage.
Social Login
Google, LinkedIn, GitHub, and Microsoft sign-in with a single click. Manages the full OAuth flow including token exchange and account linking. Handles edge cases like email conflicts between providers.
Passkeys
WebAuthn passkey sign-in with platform authenticators. Users register a passkey once and sign in with Face ID, Touch ID, or a hardware key. Works alongside password and social login.
API Tokens
Scoped API tokens for programmatic access. Each token can be named, described, activated, or revoked. Supports integrations, CI/CD pipelines, and third-party access.
Session Management
Signing out revokes the session on the server, and one call signs a user out everywhere. Users see each device they are signed in on, rename it or sign it out, and trusted devices stay signed in longer. Token refresh and configurable expiration, backed by Redis.
Agent Sign-in
Every app is an OAuth 2.0 authorization server for AI agents and third-party apps: dynamic client registration, PKCE for public clients, a consent screen, and tokens a user can revoke. No extra setup.
Custom Domains
Run authentication on a custom domain. Register domains, verify via DNS, and serve a branded sign-in experience to end users.
Security built in
Every auth endpoint is hardened by default. Encryption, rate limiting, token rotation, and brute force protection are applied automatically across all authentication flows.
- AES-256 encryption at rest
- TLS 1.3 for all traffic in transit
- Rate limiting on auth endpoints
- Secure session cookies with CSRF protection
- Automatic token rotation and expiration
- Brute-force protection on login attempts
- Email verification before activation
- Audit logs for every auth event
Role-based access control
BuildBase includes organization-level roles, workspace-level permissions, and custom roles with granular permission gates. Assign roles once and enforce them across every API endpoint and UI component.
Three users or three thousand - the permission model stays clean. Declare what each role can access. The platform enforces it everywhere.
Minutes
To integrate
Authentication typically takes 3-6 weeks to build. BuildBase is ready in minutes.
Built in
Security defaults
CSRF, rate limiting, token rotation, and brute force protection are configured out of the box.
7
Sign-in methods
Email and password, magic links, passkeys and 4 social providers - enable any combination from the dashboard.
5-line integration
Install the SDK, wrap your app, and call one hook. OAuth, magic links, sessions, and permissions are included.
import {
useSaaSAuth,
WhenAuthenticated,
WhenUnauthenticated,
} from '@buildbase/sdk/react';
function App() {
const { user, signIn, signOut, openWorkspaceSettings } = useSaaSAuth();
return (
<>
<WhenUnauthenticated>
<button onClick={() => signIn()}>Sign In</button>
</WhenUnauthenticated>
<WhenAuthenticated>
<p>Welcome, {user?.name}</p>
<button onClick={() => openWorkspaceSettings('subscription')}>
Manage Plan
</button>
<button onClick={signOut}>Sign Out</button>
</WhenAuthenticated>
</>
);
}import {
WhenAuthenticated,
WhenUnauthenticated,
WhenPermission,
Permission,
} from '@buildbase/sdk/react';
function Dashboard() {
return (
<>
<WhenUnauthenticated>
<LoginPage />
</WhenUnauthenticated>
<WhenAuthenticated>
<MainApp />
<WhenPermission permission={Permission.WORKSPACE_BILLING_MANAGE}>
<BillingSettings />
</WhenPermission>
</WhenAuthenticated>
</>
);
}Frequently Asked Questions
Do I need to build a login page?
No. BuildBase includes a white-label auth portal with login, register, magic link, email verification, and sign-out pages. It loads your org branding, auth methods, and T&C links dynamically.
Can users sign in with Google, LinkedIn, GitHub, or Microsoft?
Yes. Enable social providers in the admin dashboard. BuildBase handles the OAuth flow, token exchange, and account linking on its hosted sign-in pages.
How do sessions work?
Sessions last 30 days by default, and you can set anywhere from 1 to 180 days. Permissions refresh hourly. The SDK creates, stores and refreshes the session for you.
Is enterprise SSO or SAML supported?
No. Users sign in with email and password, magic links, passkeys, or Google, LinkedIn, GitHub and Microsoft. There is no SAML or OIDC single sign-on - if your customers require SAML, that is a real gap today.
Can I use a custom domain for the auth portal?
Yes. Register custom auth domains with DNS verification and SSL.
How does the SDK handle permissions?
Permissions resolve through 3 tiers: workspace overrides, org settings, then SDK defaults. Owners get all permissions automatically. Use <WhenPermission> for declarative UI gating.