Passwordless sign-in
Letting people in is the first problem every new build has — Authfu makes it the easiest one. People sign in with Google, Microsoft, GitHub, a passkey, or an emailed link; one integration opens every door, and you never build a login screen again.
Free for your first app. No card. No review queue.
Three sign-in providers, free with every app — and if an authenticator is enrolled, its code is checked no matter which door was used.
What you get
Nearly everyone you will ever onboard already has a Google, Microsoft, or GitHub account — and all three come free with every app. No cloud consoles, no consent-screen reviews, no expiring upstream secrets. Email links and passkeys cover everyone else.
Links single-use, minutes to live · federation never bypasses the authenticator.
If an account has an authenticator, the code is checked before any email goes out. Typing an address alone triggers nothing — no inbox spam, no way around the second step.
TOTP, backup codes, rate limits, secrets encrypted at rest.
Register apps, verify domains, manage the people who can sign in and what they can reach, and read the audit log when something looks off.
Roles, organizations, and a log of every sign-in.
Setup
Sign in at authfu.app — no password, no card — name your app, and you have a client ID and secret.
Paste the prompt below into Claude Code, Cursor, or Copilot. Your agent writes the sign-in code, sets the environment variables, and hooks up the redirect — you don’t touch a line.
Your first sign-in flips the app to Connected in the console — proof the wiring is right, not a guess.
Add sign-in to this app using Authfu. It's a standard OpenID Connect
provider with issuer https://authfu.app — discovery is at
https://authfu.app/.well-known/openid-configuration.
Read AUTHFU_CLIENT_ID and AUTHFU_CLIENT_SECRET from the environment,
add a sign-in button, and protect the dashboard route.Any language, any framework — Authfu is standard OpenID Connect, so your agent already knows how to wire it into Next.js, Rails, Django, Laravel, Go, or whatever you ship. The canonical machine-readable guide lives at authfu.dev/llms.txt.
Agent identities
live nowAI agents act on your behalf, and most of them borrow your credentials to do it. Authfu gives agents identities of their own — device authorization for CLIs, scoped tokens for MCP servers, standalone credentials for org-owned automation. Built on the open standards your stack already speaks, with every agent action attributed and audited, so you always know who — or what — did what.
Read the developer docsEach agent gets a named identity — not a copy of your session, not your API key pasted into a config file.
Scoped to what the agent needs, approved by a human, revocable in one click when the job is done.
Every sign-in and every call, attributed to the agent and to the person who authorized it.
Why this exists
“I’ve been building software for a long time, and the part that stalls every project is the same: getting people signed in without a week of OAuth paperwork. The pieces exist — Google does sign-in well, Duo does second factors well, Okta does app management well — but nobody put them in one box a single developer can paste into an app in an afternoon. So that’s what Authfu is.”