Authentication and authorization for the AI era.
Build with your coding assistant. Get your app into people’s hands without jumping through auth hoops. Authfu gives developers sign-in, roles, and scoped access for humans and agents — so you can define who gets in and what they can do.
Standard OpenID Connect. Free for your first app. No card.
Three sign-in providers, free with every app — and if an authenticator is enrolled, its code is checked no matter which door was used.
Less auth work. More product work.
Vibe coding gets you to a working app. Putting it in front of customers or coworkers means deciding who can use it — and what they can access. Authfu helps with both halves of auth.
Connect to Authfu once instead of wiring up Google, Microsoft, and GitHub separately. All three are included with every app, alongside email links and passkeys. Use Authfu’s built-in providers without managing separate provider credentials.
Standard OpenID Connect · hosted sign-in.
A successful login isn’t permission to do everything. Use roles and organizations to define access for people, and scoped tokens for agents. Enforce those permissions server-side in your application, on every protected request.
Roles · organizations · scoped agent access.
Go from your first AI-built app to the tools your team uses every day. Register applications, manage identities, and inspect sign-in activity from one console as your needs grow.
App registration · roles · organizations · audit logs.
Built for your AI coding workflow
Create an app at authfu.app, register your callback URL, and get your client ID and secret.
Paste this prompt into your coding assistant. The integration guide gives it Authfu’s endpoints, configuration, and sign-in flow to work from. Keep your client secret in your server environment, not in the chat.
Review the generated integration. Test sign-in, then verify that signed-out users, people without permission, and requests for another organization’s data are denied. Keep access checks server-side before you ship.
Add authentication and authorization to this app using Authfu.
It's a standard OpenID Connect
provider with issuer https://authfu.app — discovery is at
https://authfu.app/.well-known/openid-configuration.
Read AUTHFU_CLIENT_ID and AUTHFU_CLIENT_SECRET from the environment,
register the callback URL, add a sign-in button, and protect the dashboard
route. Keep the client secret server-side. Read https://authfu.dev/llms.txt
for the integration details and popup sign-in pattern.
Define the roles and permissions this app needs, using the documented
Authfu claims and scopes. Validate sessions or tokens server-side and
enforce permissions on every protected route, API, and resource.
Deny access by default; hiding a button is not authorization.
Add tests for signed-out requests, insufficient permissions, and attempts
to access another user's or organization's data. Review before shipping.The machine-readable guide at authfu.dev/llms.txt gives your assistant concrete integration instructions. Authfu uses standard OpenID Connect, so you can also integrate directly with your framework’s OIDC client and the developer docs.
Auth for the agents you build
live nowAdd authentication to your CLI, MCP server, or background automation without sharing a person’s session. Authfu supports device authorization, scoped tokens, and credentials for org-owned agents. Give each agent an identity, limit its access, and revoke it when the job is done.
Read the developer docsEach agent gets a named identity — not a copy of your session, not your API key pasted into a config file.
Scoped to what the agent needs, approved by a human, revocable in one click when the job is done.
Use Authfu’s audit trail to investigate agent authentication and access, alongside your application’s own logs.
AI governance starts with controlled access
Who is this agent acting for? What can it access? Who can withdraw that access? Authfu provides identity and access controls that support your AI governance program, starting with the applications and agents you build.
Give agents named identities. Distinguish agents acting for a person from organization-owned agents with their own access.
Use roles and scopes to define access. Restrict which models an agent can call through Authfu Router, and enforce application permissions server-side.
Investigate authentication and access events in Authfu’s audit trail. Revoke agent credentials when access is no longer needed.
Authfu covers the identity and access layer, not model evaluation or a complete compliance program. Router policies apply to calls through Authfu Router; your application must enforce its own permissions. Revoking Authfu access does not automatically revoke credentials already issued by third-party providers.
Start with your first appWhy this exists
“I’ve been building software for a long time, and the part that stalls every project is the same: getting people signed in without a week of OAuth paperwork. The pieces exist — Google does sign-in well, Duo does second factors well, Okta does app management well — but nobody put them in one box a single developer can paste into an app in an afternoon. So that’s what Authfu is.”