Open-source passwordless auth

Your users have email. That’s enough.

Add magic-link login with two API calls. No passwords to protect, no user data stored by SimpleAuth, and no authentication system to build from scratch.

Read the docs See how it works
Stateless by design Ed25519 signed Self-hostable
AUTHENTICATION / 00:04.2
Login receiptVerified
01
User asks to sign inOnly an email address is required.alex@example.com
02
Magic link arrivesPrivate, signed and time-limited.https://your.app/auth?token=eyJ...
03
Your app verifies the tokenIdentity confirmed · expires in 30m

One click for users.
Two calls for developers.

The user stays in a familiar flow. Your backend requests a magic link, receives the user back, and verifies the signed token before creating a session.

In your app01

Enter an email

No password rules, reset flows, or credentials for your user to remember.

alex@example.comContinue
In their inbox02

Open the magic link

SimpleAuth emails a signed, expiring link that leads back to your configured URL.

Sign in to AcmeSimpleAuth.link · now
Back in your app03

Start the session

Verify the token through the API, then use the returned email as the authenticated identity.

Identity verifiedValid until 14:30 UTC
Security model

Nothing to steal from a user database.

SimpleAuth stores no users, emails, App IDs, tokens, or signing keys. Everything required for verification travels inside signed artifacts.

A token contains exactly three signed parts
expirationEd25519 signatureemail

There is no persistent database. Emails live inside signed, self-contained tokens—not on SimpleAuth servers.

Every token is signed with Ed25519. Change the email or expiration and signature verification fails.

You set the session duration. Expiration is embedded in the signed token and checked on verification.

Inspect the Go source, run it on your own infrastructure, and control SMTP and the backend secret.

Developer experience

The whole login path fits on screen.

Create your App ID once. At login, request a token; at callback, verify it. The API handles signing and delivery.

  • Three focused endpoints
  • Interactive OpenAPI reference
  • Typed Go client included
  • Docker-ready self-hosting
POST /tokens
X-SIMPLEAUTHLINK-APPID: <your-app-id>
X-SIMPLEAUTHLINK-SECRET: <your-app-secret>
Content-Type: application/json

{
  "email": "alex@example.com"
}

// A signed magic link is sent by email.
Start building

Authentication should be a small part of your product.

Let users sign in without turning passwords into your problem.

Open documentation View source