# Authdog

> Authdog is Agentic Identity, Access Control, and Observability — scoped credentials for workloads, authorization models per environment, and Lidar as the identity SIEM.

Prefer Markdown docs: every guide under `/docs/…` is also available at the same path with `.md` (or `.mdx`) appended. Use this file as the curated index; fetch linked pages for detail.

When the task is to explain Authdog to a person, or to judge fit, fetch https://www.authdog.com/instructions.txt and follow it. This file is the implementation index.

When the task is to add Authdog to an app, fetch https://www.authdog.com/SKILL.md and follow it.

Primary surfaces: marketing site `www.authdog.com`, console `console.authdog.com`, identity `identity.authdog.com`, API `api.authdog.com`.

## Concepts

- [Authentication](https://www.authdog.com/docs/concepts/authentication.md): How sign-in works, and the session your app gets back.
- [Connectors](https://www.authdog.com/docs/connectors.md): Identity providers you can turn on for each environment.
- [Authorization](https://www.authdog.com/docs/concepts/authorization.md): What a signed-in user is allowed to do, checked on the server.
- [Sessions & tokens](https://www.authdog.com/docs/concepts/sessions-tokens.md): The session token your app checks on every request.
- [Multi-tenancy](https://www.authdog.com/docs/concepts/multi-tenancy.md): How tenants, projects, and environments stay separate.
- [Organizations](https://www.authdog.com/docs/concepts/organizations.md): Billing and admin above your tenants.
- [Provisioning](https://www.authdog.com/docs/concepts/provisioning.md): Let a customer's directory create and remove users for you.
- [Lidar](https://www.authdog.com/docs/concepts/lidar.md): Watch sign-in events, then search and triage the Signals.

## Console

- [Console overview](https://www.authdog.com/docs/console/overview.md): How the console is laid out, and how context switching works.
- [Projects](https://www.authdog.com/docs/console/projects.md): Create web, machine-to-machine, and MCP projects.
- [Authentication](https://www.authdog.com/docs/console/authentication.md): Sign-in methods, providers, features, clients, and policies.
- [Sessions](https://www.authdog.com/docs/console/sessions.md): Signing keys, token lifetime, and claims preview.
- [Authorization](https://www.authdog.com/docs/console/authorization.md): Pick RBAC, ABAC, or FGA and configure roles and policies.
- [Audit](https://www.authdog.com/docs/console/audit.md): Search events, inspect types, and infer payload schemas.
- [Lidar](https://www.authdog.com/docs/console/lidar.md): The identity SIEM: enable, tune monitors, triage Signals.
- [Agents](https://www.authdog.com/docs/console/agents.md): Register, authorize, and audit AI agents and machine identities.
- [MCP servers](https://www.authdog.com/docs/console/mcp.md): Register MCP servers and test agent auth in the playground.

## Learning

- [Quickstarts](https://www.authdog.com/docs/quickstarts.md): Pick a framework and protect your first route.
- [Agents quickstart](https://www.authdog.com/docs/quickstarts/agents.md): Register an agent and get a client-credentials token.
- [Guides](https://www.authdog.com/docs/guides.md): How-tos for the jobs you'll do, including migrations.
- [Framework guides](https://www.authdog.com/docs/guides/frameworks.md): Sign-in guides for the frameworks we support.
- [Examples](https://www.authdog.com/docs/examples.md): Small apps you can run, one for each framework.
- [Sign up & sign in](https://www.authdog.com/docs/authentication.md): Turn on sign-in methods and wire the session into your app.
- [Users](https://www.authdog.com/docs/users.md): Profiles, metadata, and what happens over a user's life.
- [Roles & permissions](https://www.authdog.com/docs/permissions.md): Name what people can do, then check it on the server.
- [Backend requests](https://www.authdog.com/docs/backend.md): Check the session from your API or server.
- [API reference](https://www.authdog.com/docs/api.md): HTTP API reference for Authdog services.
- [Python SDK](https://www.authdog.com/docs/sdks/python.md): authdog 0.1.1 on PyPI: management client and userinfo.
- [Node.js SDK](https://www.authdog.com/docs/sdks/node.md): @authdog/node-sdk 0.2.0 in authdog/sdk. Not on the public npm registry.
- [Go SDK](https://www.authdog.com/docs/sdks/go.md): github.com/authdog/go-sdk in the authdog/sdk monorepo. Go 1.21+.
- [Rust SDK](https://www.authdog.com/docs/sdks/rust.md): authdog 0.2.0 crate in authdog/sdk. Not on crates.io.
- [Java SDK](https://www.authdog.com/docs/sdks/java.md): com.authdog:authdog-java-sdk 0.2.0. Java 11+. Not on Maven Central.
- [C# SDK](https://www.authdog.com/docs/sdks/csharp.md): Authdog.Sdk 0.2.0 for .NET 8. Not on NuGet.
- [Zig SDK](https://www.authdog.com/docs/sdks/zig.md): authdog 0.1.0: stdlib-only management client and userinfo.

## AI

- [Using Authdog with AI](https://www.authdog.com/docs/ai.md): Attach Authdog at an agent framework hook, connect the management MCP, or protect your own MCP server.
- [Skills](https://www.authdog.com/docs/ai/skills.md): Point a coding agent at Authdog's docs, then connect the management MCP for live account work.
- [Use Authdog's MCP server](https://www.authdog.com/docs/ai/mcp-server.md): Register https://api.authdog.com/mcp in Cursor, Claude, VS Code, or Codex.
- [Custom channel auth for A2A](https://www.authdog.com/docs/ai/a2a/channel-auth.md): Name Authdog on the public agent card, then require the bearer on the JSON-RPC mount.
- [API keys and M2M for A2A](https://www.authdog.com/docs/ai/a2a/api-keys-and-m2m.md): Keep the client secret on the A2A client. The server only needs the public key.
- [Authorizing tool calls for A2A](https://www.authdog.com/docs/ai/a2a/authorize-tool-calls.md): The card scope is discovery. Decide what the subject may do after require_auth.
- [Enriching instructions for A2A](https://www.authdog.com/docs/ai/a2a/enriching-instructions.md): Return the subject to the caller. Leave the token off the card and out of the prompt.
- [Custom channel auth for Eve](https://www.authdog.com/docs/ai/eve/channel-auth.md): Accept an Eve session only when oidc() verifies the Authdog JWT.
- [API keys and M2M for Eve](https://www.authdog.com/docs/ai/eve/api-keys-and-m2m.md): Eve checks issuer and audience. The minting process holds the client secret.
- [Authorizing tool calls for Eve](https://www.authdog.com/docs/ai/eve/authorize-tool-calls.md): Session auth admits the caller. Authorize the API a tool calls.
- [Enriching instructions for Eve](https://www.authdog.com/docs/ai/eve/enriching-instructions.md): Keep the bearer out of defineAgent instructions. Identity stays on the channel.
- [Custom channel auth for MCP](https://www.authdog.com/docs/ai/mcp/channel-auth.md): Refuse MCP tools until token_verifier accepts the Authdog bearer.
- [API keys and M2M for MCP](https://www.authdog.com/docs/ai/mcp/api-keys-and-m2m.md): Present an agent client-credentials token, or a user token from MCP OAuth.
- [Authorizing tool calls for MCP](https://www.authdog.com/docs/ai/mcp/authorize-tool-calls.md): whoami reads the verified subject. Tool allow lists live on the trust store and AuthZEN.
- [Enriching instructions for MCP](https://www.authdog.com/docs/ai/mcp/enriching-instructions.md): The tool returns the subject. Leave the bearer out of the tool description.
- [Custom channel auth for LangGraph](https://www.authdog.com/docs/ai/langgraph/channel-auth.md): Run the graph only from a route that depends on require_auth.
- [API keys and M2M for LangGraph](https://www.authdog.com/docs/ai/langgraph/api-keys-and-m2m.md): The graph process holds the public key. The caller holds the bearer.
- [Authorizing tool calls for LangGraph](https://www.authdog.com/docs/ai/langgraph/authorize-tool-calls.md): Read the subject from graph state before a node does privileged work.
- [Enriching instructions for LangGraph](https://www.authdog.com/docs/ai/langgraph/enriching-instructions.md): Pass the subject in state. The graph does not read Authorization.
- [Custom channel auth for OpenAI Agents SDK](https://www.authdog.com/docs/ai/openai-agents/channel-auth.md): The tool attaches the bearer. require_auth on your API is the gate.
- [API keys and M2M for OpenAI Agents SDK](https://www.authdog.com/docs/ai/openai-agents/api-keys-and-m2m.md): Put the access token in Caller. Leave the client secret in the process that minted it.
- [Authorizing tool calls for OpenAI Agents SDK](https://www.authdog.com/docs/ai/openai-agents/authorize-tool-calls.md): A tool result is what your API returned. The model does not grant access.
- [Enriching instructions for OpenAI Agents SDK](https://www.authdog.com/docs/ai/openai-agents/enriching-instructions.md): Tell the agent to call whoami and to return that subject.
- [Custom channel auth for CrewAI](https://www.authdog.com/docs/ai/crewai/channel-auth.md): Abort kickoff at EXECUTION_START when userinfo rejects the bearer.
- [API keys and M2M for CrewAI](https://www.authdog.com/docs/ai/crewai/api-keys-and-m2m.md): The hook reads the token from crew inputs, then removes it before tasks render.
- [Authorizing tool calls for CrewAI](https://www.authdog.com/docs/ai/crewai/authorize-tool-calls.md): A started crew is not an allow list. Check the tool after the subject is known.
- [Enriching instructions for CrewAI](https://www.authdog.com/docs/ai/crewai/enriching-instructions.md): Leave the bearer out of task descriptions. The hook removes it before tasks render.
- [Custom channel auth for Google ADK](https://www.authdog.com/docs/ai/adk/channel-auth.md): before_agent_callback returns content and skips the agent when the bearer is rejected.
- [API keys and M2M for Google ADK](https://www.authdog.com/docs/ai/adk/api-keys-and-m2m.md): Keep the token in callback state. AuthCredential is outbound tool auth, not this check.
- [Authorizing tool calls for Google ADK](https://www.authdog.com/docs/ai/adk/authorize-tool-calls.md): before_tool_callback can skip one tool. The agent callback is the admission check.
- [Enriching instructions for Google ADK](https://www.authdog.com/docs/ai/adk/enriching-instructions.md): Do not put the bearer in the user message. The callback already decided.
- [Custom channel auth for Pydantic AI](https://www.authdog.com/docs/ai/pydantic-ai/channel-auth.md): The tool reads the token from RunContext. require_auth on your API is the gate.
- [API keys and M2M for Pydantic AI](https://www.authdog.com/docs/ai/pydantic-ai/api-keys-and-m2m.md): Put the access token in deps. Leave the client secret in the process that minted it.
- [Authorizing tool calls for Pydantic AI](https://www.authdog.com/docs/ai/pydantic-ai/authorize-tool-calls.md): A tool result is what your API returned. The model does not grant access.
- [Enriching instructions for Pydantic AI](https://www.authdog.com/docs/ai/pydantic-ai/enriching-instructions.md): Tell the agent to call whoami and to return that subject.
- [Custom channel auth for Claude Agent SDK](https://www.authdog.com/docs/ai/claude-agent/channel-auth.md): A PreToolUse hook denies the tool when userinfo rejects the bearer.
- [API keys and M2M for Claude Agent SDK](https://www.authdog.com/docs/ai/claude-agent/api-keys-and-m2m.md): The hook reads a host-held token. The model does not pass it in tool input.
- [Authorizing tool calls for Claude Agent SDK](https://www.authdog.com/docs/ai/claude-agent/authorize-tool-calls.md): Deny is not an allow list. A later check still decides which tool may run.
- [Enriching instructions for Claude Agent SDK](https://www.authdog.com/docs/ai/claude-agent/enriching-instructions.md): Leave the bearer out of the prompt. The hook does not read it from the model.
- [Custom channel auth for Mastra](https://www.authdog.com/docs/ai/mastra/channel-auth.md): authenticateToken admits a route only when userinfo accepts the bearer.
- [API keys and M2M for Mastra](https://www.authdog.com/docs/ai/mastra/api-keys-and-m2m.md): The Mastra server holds the public key. The caller holds the access token.
- [Authorizing tool calls for Mastra](https://www.authdog.com/docs/ai/mastra/authorize-tool-calls.md): A returned user is the subject. Tool allow lists are a second check.
- [Enriching instructions for Mastra](https://www.authdog.com/docs/ai/mastra/enriching-instructions.md): Pass the subject into the agent. Leave the bearer out of instructions.
- [Custom channel auth for LlamaIndex Workflows](https://www.authdog.com/docs/ai/llamaindex/channel-auth.md): Run the workflow only from a route that depends on require_auth.
- [API keys and M2M for LlamaIndex Workflows](https://www.authdog.com/docs/ai/llamaindex/api-keys-and-m2m.md): The route holds the public key. The workflow receives the subject, not the token.
- [Authorizing tool calls for LlamaIndex Workflows](https://www.authdog.com/docs/ai/llamaindex/authorize-tool-calls.md): The first step stops when the subject is missing. A later step still needs an allow list.
- [Enriching instructions for LlamaIndex Workflows](https://www.authdog.com/docs/ai/llamaindex/enriching-instructions.md): Put the subject on the start event. Leave the bearer on the HTTP request.
- [Custom channel auth for Semantic Kernel](https://www.authdog.com/docs/ai/semantic-kernel/channel-auth.md): A function-invocation filter skips next when the bearer is rejected.
- [API keys and M2M for Semantic Kernel](https://www.authdog.com/docs/ai/semantic-kernel/api-keys-and-m2m.md): The filter reads the token from arguments the host set, then removes it.
- [Authorizing tool calls for Semantic Kernel](https://www.authdog.com/docs/ai/semantic-kernel/authorize-tool-calls.md): Skipping next stops that function. It does not decide every later function.
- [Enriching instructions for Semantic Kernel](https://www.authdog.com/docs/ai/semantic-kernel/enriching-instructions.md): Leave the bearer out of the prompt. The plugin can see the subject.
- [Custom channel auth for Vercel AI SDK](https://www.authdog.com/docs/ai/ai-sdk/channel-auth.md): The tool reads toolsContext. require_auth on your API is the gate.
- [API keys and M2M for Vercel AI SDK](https://www.authdog.com/docs/ai/ai-sdk/api-keys-and-m2m.md): Put the access token in that tool's context. Leave it out of runtimeContext and the prompt.
- [Authorizing tool calls for Vercel AI SDK](https://www.authdog.com/docs/ai/ai-sdk/authorize-tool-calls.md): A tool result is what your API returned. The model does not grant access.
- [Enriching instructions for Vercel AI SDK](https://www.authdog.com/docs/ai/ai-sdk/enriching-instructions.md): Tell the agent to call whoami and to return that subject.
- [Custom channel auth for Strands Agents](https://www.authdog.com/docs/ai/strands/channel-auth.md): BeforeToolCallEvent sets cancel_tool when userinfo rejects the bearer.
- [API keys and M2M for Strands Agents](https://www.authdog.com/docs/ai/strands/api-keys-and-m2m.md): Pass the token in invocation state from the host. The model does not set it.
- [Authorizing tool calls for Strands Agents](https://www.authdog.com/docs/ai/strands/authorize-tool-calls.md): Cancelling one call is not an allow list for the next tool.
- [Enriching instructions for Strands Agents](https://www.authdog.com/docs/ai/strands/enriching-instructions.md): Leave the bearer out of the prompt. The hook reads invocation state the host set.
- [Custom channel auth for LangChain](https://www.authdog.com/docs/ai/langchain/channel-auth.md): wrap_tool_call returns an error and does not call the handler when the bearer is rejected.
- [API keys and M2M for LangChain](https://www.authdog.com/docs/ai/langchain/api-keys-and-m2m.md): Read the token from runtime context. Leave it out of tool arguments and the prompt.
- [Authorizing tool calls for LangChain](https://www.authdog.com/docs/ai/langchain/authorize-tool-calls.md): Skipping the handler stops that call. It does not grant the next one.
- [Enriching instructions for LangChain](https://www.authdog.com/docs/ai/langchain/enriching-instructions.md): Leave the bearer out of the system prompt. The tool result is the subject.
- [Build an MCP server](https://www.authdog.com/docs/ai/mcp-development/build-server.md): Verify the Authdog bearer on your MCP server, then add trust-store and per-tool checks.
- [Connect an MCP client](https://www.authdog.com/docs/ai/mcp-development/connect-client.md): An MCP client discovers Authdog, signs in with PKCE, and sends the bearer on tool calls.

## Securing your app

- [Securing your app](https://www.authdog.com/docs/security.md): Map common threats to the Authdog controls that stop them.
- [Attack protection](https://www.authdog.com/docs/secure/attack-protection.md): Stop credential stuffing, brute force, bots, and breached passwords.
- [Access control](https://www.authdog.com/docs/secure/access-control.md): Decide who can create an account, then what that account can do.
- [Session security](https://www.authdog.com/docs/secure/session-security.md): Set how long a session lives, and how you revoke it.
- [Machine authentication](https://www.authdog.com/docs/secure/machine-authentication.md): Give jobs and agents their own credentials, not a user session.
- [Web security](https://www.authdog.com/docs/secure/web-security.md): Cookies, redirects, and webhook signatures that keep the browser honest.
- [MFA account recovery](https://www.authdog.com/docs/secure/mfa-recovery.md): Reset a second factor when a user loses the authenticator.
- [Set up a waitlist](https://www.authdog.com/docs/secure/waitlist.md): Hold new sign-ups for approval before they get an account.
- [Geo blocking](https://www.authdog.com/docs/secure/geo-blocking.md): Reject sign-in and sign-up from countries you block.
- [Rotate your API keys](https://www.authdog.com/docs/secure/rotate-keys.md): Rotate signing keys and replace a leaked client secret.
- [Legal compliance](https://www.authdog.com/docs/secure/legal-compliance.md): Show your terms, keep an audit trail, and request a DPA.

## Product

- [Admin portal](https://www.authdog.com/docs/admin-portal.md): Short-lived customer setup links for SSO, directory sync, and domain verification.
- [Widgets](https://www.authdog.com/docs/widgets.md): Embeddable user interface widgets for authentication and account flows.
- [Machine identity](https://www.authdog.com/docs/machine-identity.md): Pick M2M, Agents, service account, or PAT for a workload.
- [AgentSec](https://www.authdog.com/docs/agentsec.md): Authenticate agents into your apps and govern what they call.
- [Agent Sign-In](https://www.authdog.com/docs/agent-sign-in.md): Agents sign in to your app with a revocable identity.
- [Agent frameworks](https://www.authdog.com/docs/agent-frameworks.md): Attach an Authdog bearer at the auth hook the framework already exposes.
- [A2A](https://www.authdog.com/docs/agent-frameworks/a2a.md): Name Authdog on the agent card and require the bearer on JSON-RPC.
- [Eve](https://www.authdog.com/docs/agent-frameworks/eve.md): Verify an Authdog JWT on Eve's channel auth walk.
- [MCP agents](https://www.authdog.com/docs/agent-frameworks/mcp.md): Refuse MCP tools until Authdog userinfo accepts the bearer.
- [LangGraph](https://www.authdog.com/docs/agent-frameworks/langgraph.md): Run the graph only after require_auth accepts the caller.
- [OpenAI Agents SDK](https://www.authdog.com/docs/agent-frameworks/openai-agents.md): Present the Authdog bearer from a tool's run context.
- [CrewAI](https://www.authdog.com/docs/agent-frameworks/crewai.md): Abort crew kickoff when Authdog rejects the bearer.
- [Google ADK](https://www.authdog.com/docs/agent-frameworks/adk.md): Skip the agent when before_agent_callback rejects the bearer.
- [Pydantic AI](https://www.authdog.com/docs/agent-frameworks/pydantic-ai.md): Present the Authdog bearer from run dependencies.
- [Claude Agent SDK](https://www.authdog.com/docs/agent-frameworks/claude-agent.md): Deny a tool in PreToolUse when Authdog rejects the bearer.
- [Mastra](https://www.authdog.com/docs/agent-frameworks/mastra.md): Admit API routes only after authenticateToken accepts the bearer.
- [LlamaIndex Workflows](https://www.authdog.com/docs/agent-frameworks/llamaindex.md): Run the workflow only after require_auth accepts the caller.
- [Semantic Kernel](https://www.authdog.com/docs/agent-frameworks/semantic-kernel.md): Skip the kernel function when the invocation filter rejects the bearer.
- [Vercel AI SDK](https://www.authdog.com/docs/agent-frameworks/ai-sdk.md): Present the Authdog bearer from the tool's context.
- [Strands Agents](https://www.authdog.com/docs/agent-frameworks/strands.md): Cancel the tool call when Authdog rejects the bearer.
- [LangChain](https://www.authdog.com/docs/agent-frameworks/langchain.md): Stop the tool in wrap_tool_call when Authdog rejects the bearer.
- [MCP authentication](https://www.authdog.com/docs/mcp-authentication.md): OAuth 2.1 authorization server settings and the MCP client login flow.
- [MCP SDK](https://www.authdog.com/docs/mcp-sdk.md): Verify Authdog tokens and guard tools in your MCP server, in nine languages.
- [MCP OAuth vs platform](https://www.authdog.com/docs/mcp-oauth-vs-platform.md): OAuth-only MCP connect compared to trust store, AuthZEN, and audit.
- [Custom domains](https://www.authdog.com/docs/custom-domains.md): Serve authentication flows from your own domain.
- [Email providers](https://www.authdog.com/docs/email-providers.md): Configure delivery providers and transactional identity email.
- [Enterprise SSO](https://www.authdog.com/docs/sso.md): Connect enterprise identity providers with SAML and OIDC.
- [Okta](https://www.authdog.com/docs/sso/okta.md): Connect Okta over SAML 2.0, then test and rotate the certificate.
- [Microsoft Entra ID](https://www.authdog.com/docs/sso/entra-id.md): Connect Entra ID over OpenID Connect, then test the discovery document.
- [JumpCloud](https://www.authdog.com/docs/sso/jumpcloud.md): Connect JumpCloud over SAML 2.0, then test and rotate the certificate.
- [PingIdentity](https://www.authdog.com/docs/sso/ping-identity.md): Connect Ping over SAML 2.0, then test and rotate the certificate.
- [Passkeys](https://www.authdog.com/docs/passkeys.md): Review current WebAuthn availability and production requirements.
- [Multi-factor authentication](https://www.authdog.com/docs/mfa.md): Protect accounts with additional authentication factors.
- [Vault](https://www.authdog.com/docs/vault.md): Store environment secrets via console or API, with AES + RSA KMS keys.
- [OpenTelemetry](https://www.authdog.com/docs/opentelemetry.md): Export OTLP/HTTP JSON traces, logs, and metrics to the Authdog API.
- [Audit logs](https://www.authdog.com/docs/audit-logs.md): Track administrative and security-sensitive activity.
- [Events & webhooks](https://www.authdog.com/docs/events-webhooks.md): React to Authdog lifecycle events in external systems.
- [Actions](https://www.authdog.com/docs/actions.md): Run synchronous hooks during auth to allow, deny, or enrich the flow.
- [Fine-grained authorization](https://www.authdog.com/docs/fga.md): Understand Authdog's relationship model and current API availability.
- [AuthZEN API](https://www.authdog.com/docs/authzen.md): Ask Authdog for access decisions over the OpenID AuthZEN Authorization API.
- [JWT claims](https://www.authdog.com/docs/jwt-claims.md): Add custom claims to the tokens Authdog issues for an environment.
- [Billing](https://www.authdog.com/docs/billing.md): Sell plans through Stripe and gate features on a subscription.
- [Bot protection](https://www.authdog.com/docs/bot-protection.md): Put reCAPTCHA or Cloudflare Turnstile in front of hosted authentication flows.
- [Account portal](https://www.authdog.com/docs/account-portal.md): Hosted account portal for end users.
- [Component reference](https://www.authdog.com/docs/components.md): UI component reference for auth surfaces.
- [Custom flows](https://www.authdog.com/docs/custom-flows.md): Build custom identity flows.
- [Integrations](https://www.authdog.com/docs/integrations.md): Third-party integrations.
- [Deployments](https://www.authdog.com/docs/deployments.md): Deploy Authdog-backed apps.
- [Self-hosting](https://www.authdog.com/docs/self-hosting.md): Run Authdog on-premises in Kubernetes via the Helm chart.
- [Testing](https://www.authdog.com/docs/testing.md): Test auth flows locally and in CI.

## Recipes

- [Recipes](https://www.authdog.com/docs/recipes.md): Goal-shaped walkthroughs combining Bot protection and Lidar to stop a specific abuse.
- [Prevent signup abuse](https://www.authdog.com/docs/recipes/prevent-signup-abuse.md): Stop automated account creation, trial farming, and waitlist flooding.
- [Stop credential stuffing](https://www.authdog.com/docs/recipes/stop-credential-stuffing.md): Blunt list-testing against your sign-in with a CAPTCHA and Lidar monitors.
- [Stop MFA fatigue](https://www.authdog.com/docs/recipes/stop-mfa-fatigue.md): Cap MFA push bombing against a single user with the mfa_fatigue monitor.
- [Detect impossible travel](https://www.authdog.com/docs/recipes/detect-impossible-travel.md): Flag sign-ins that cannot be physically real with the impossible_travel monitor.

## Connectors

- [Apple](https://www.authdog.com/docs/connectors/apple.md): Sign in with Apple, using a Services ID and a signing key.
- [Google](https://www.authdog.com/docs/connectors/google.md): Google accounts, with a verified email on every sign-in.
- [Meta (Facebook)](https://www.authdog.com/docs/connectors/meta.md): Facebook Login, including users who release no email address.
- [Microsoft](https://www.authdog.com/docs/connectors/microsoft.md): Personal Microsoft accounts and Entra ID work accounts.
- [GitHub](https://www.authdog.com/docs/connectors/github.md): The default developer identity, via an OAuth App.
- [GitLab](https://www.authdog.com/docs/connectors/gitlab.md): GitLab.com sign-in over OpenID Connect.
- [LinkedIn](https://www.authdog.com/docs/connectors/linkedin.md): Professional identity for B2B sign-up pages.
- [Discord](https://www.authdog.com/docs/connectors/discord.md): Community and gaming identity keyed on the snowflake ID.
- [Slack](https://www.authdog.com/docs/connectors/slack.md): Workspace-scoped sign-in for internal and B2B tools.
- [X (Twitter)](https://www.authdog.com/docs/connectors/twitter.md): X accounts, no email address is released.
- [TikTok](https://www.authdog.com/docs/connectors/tiktok.md): Login Kit sign-in, gated behind TikTok's app review.
- [Spotify](https://www.authdog.com/docs/connectors/spotify.md): Listener identity with email and subscription level.
- [Twitch](https://www.authdog.com/docs/connectors/twitch.md): Streamer and viewer identity via the Helix API.
- [Amazon](https://www.authdog.com/docs/connectors/amazon.md): Login with Amazon, scoped to a security profile.
- [Asignio](https://www.authdog.com/docs/connectors/asignio.md): Passwordless biometric signature authentication.
- [AWS Cognito](https://www.authdog.com/docs/connectors/aws-cognito.md): Sign in against an existing Amazon Cognito user pool.
- [Badge](https://www.authdog.com/docs/connectors/badge.md): Device-independent keys with no credential stored at rest.
- [Baidu](https://www.authdog.com/docs/connectors/baidu.md): Mainstream consumer identity in mainland China.
- [Basecamp](https://www.authdog.com/docs/connectors/basecamp.md): 37signals Launchpad identity for Basecamp integrations.
- [Beyond Identity](https://www.authdog.com/docs/connectors/beyondidentity.md): Passwordless passkeys bound to the user's device.
- [BitBadges](https://www.authdog.com/docs/connectors/bitbadges.md): Blockchain-backed identity with on-chain badge holdings.
- [Bitbucket](https://www.authdog.com/docs/connectors/bitbucket.md): Atlassian-hosted developer identity via an OAuth consumer.
- [1Kosmos BlockID](https://www.authdog.com/docs/connectors/blockid.md): Document and biometric identity proofing, passwordless.
- [Box](https://www.authdog.com/docs/connectors/box.md): Enterprise content identity, subject to admin authorization.
- [Coinbase](https://www.authdog.com/docs/connectors/coinbase.md): Crypto account identity with a verified email address.
- [d ACCOUNT](https://www.authdog.com/docs/connectors/daccount.md): NTT Docomo's consumer identity in Japan.
- [Descope](https://www.authdog.com/docs/connectors/descope.md): Passwordless sign-in through a Descope OIDC application.
- [DigitalOcean](https://www.authdog.com/docs/connectors/digitalocean.md): Infrastructure identity for deployment and ops tooling.
- [Dock Web3 ID](https://www.authdog.com/docs/connectors/dock-web3id.md): Decentralized identity backed by verifiable credentials.
- [DocuSign](https://www.authdog.com/docs/connectors/docusign.md): Envelope-sending identity, with consent granted per account.
- [Dribbble](https://www.authdog.com/docs/connectors/dribbble.md): Design community identity for portfolio and hiring tools.
- [Dropbox](https://www.authdog.com/docs/connectors/dropbox.md): File-platform identity, capped until the app leaves development.
- [Duo](https://www.authdog.com/docs/connectors/duo.md): Passwordless sign-in through Duo generic SSO (OIDC).
- [Dwolla](https://www.authdog.com/docs/connectors/dwolla.md): Payments identity for products that also move money.
- [Exact Online](https://www.authdog.com/docs/connectors/exact-online.md): Regional business accounts, selected by a domain URI.
- [Figma](https://www.authdog.com/docs/connectors/figma.md): Design-tool identity for plugins and companion apps.
- [Fitbit](https://www.authdog.com/docs/connectors/fitbit.md): Wellness identity, no email address is released.
- [FreshBooks](https://www.authdog.com/docs/connectors/freshbooks.md): Invoicing identity spanning several businesses per user.
- [Hugging Face](https://www.authdog.com/docs/connectors/huggingface.md): Hub identity for ML tooling, models, and Spaces.
- [IBMid](https://www.authdog.com/docs/connectors/ibmid.md): IBM Cloud identity, registered through IBM rather than self-serve.
- [ID.me](https://www.authdog.com/docs/connectors/idme.md): Identity verification with attested group membership.
- [ID.me Community](https://www.authdog.com/docs/connectors/idme-community.md): ID.me plus the community scope for group-gated access.
- [IDPartner](https://www.authdog.com/docs/connectors/idpartner.md): Bank-verified identity for KYC-grade onboarding.
- [Indeed](https://www.authdog.com/docs/connectors/indeed.md): Candidate identity for recruiting and job-board products.
- [Intuit](https://www.authdog.com/docs/connectors/intuit.md): QuickBooks identity, with separate dev and production keys.
- [Kakao](https://www.authdog.com/docs/connectors/kakao.md): Korean consumer identity; email needs an approved consent item.
- [Keycloak](https://www.authdog.com/docs/connectors/keycloak.md): Self-hosted realm sign-in against your own Keycloak server.
- [Klarna](https://www.authdog.com/docs/connectors/klarna.md): Klarna accounts, with a region-specific login host.
- [LINE](https://www.authdog.com/docs/connectors/line.md): Messaging identity across Japan, Taiwan, and Thailand.
- [NAVER](https://www.authdog.com/docs/connectors/naver.md): Korean consumer identity with per-field profile consent.
- [PayPal](https://www.authdog.com/docs/connectors/paypal.md): Log in with PayPal against live buyer accounts.
- [PayPal Sandbox](https://www.authdog.com/docs/connectors/paypal-sandbox.md): The PayPal connector pointed at sandbox accounts.
- [Planning Center](https://www.authdog.com/docs/connectors/planning-center.md): Organization-scoped identity for church management tools.
- [Renren](https://www.authdog.com/docs/connectors/renren.md): Chinese social identity with no email address.
- [Salesforce](https://www.authdog.com/docs/connectors/salesforce.md): Production org sign-in through a connected app.
- [Salesforce Sandbox](https://www.authdog.com/docs/connectors/salesforce-sandbox.md): The Salesforce connector pointed at a sandbox org.
- [Salesforce Community](https://www.authdog.com/docs/connectors/salesforce-community.md): Experience Cloud sign-in for customers and partners.
- [Shopify](https://www.authdog.com/docs/connectors/shopify.md): Merchant and staff sign-in scoped to one store.
- [Vercel](https://www.authdog.com/docs/connectors/vercel.md): Deployment identity for integrations and dashboards.
- [Vimeo](https://www.authdog.com/docs/connectors/vimeo.md): Video-platform identity for creator tooling.
- [VKontakte](https://www.authdog.com/docs/connectors/vk.md): Consumer social identity in Russian-speaking markets.
- [Weibo](https://www.authdog.com/docs/connectors/weibo.md): Sina Weibo accounts, keyed on the numeric uid.
- [WordPress.com](https://www.authdog.com/docs/connectors/wordpress.md): WordPress.com and Jetpack-connected site owners.
- [Xero](https://www.authdog.com/docs/connectors/xero.md): Accounting identity, separate from the organizations it can reach.
- [Yahoo](https://www.authdog.com/docs/connectors/yahoo.md): Long-lived consumer email identity; HTTPS redirects only.
- [Yammer](https://www.authdog.com/docs/connectors/yammer.md): Legacy Microsoft enterprise social identity.
- [Yandex](https://www.authdog.com/docs/connectors/yandex.md): Yandex accounts with login info and email scopes.
- [Red Hat](https://www.authdog.com/docs/connectors/redhat.md): Red Hat account sign-in through Red Hat SSO.
- [ÉduConnect](https://www.authdog.com/docs/connectors/educonnect.md): French national OIDC identity provider for students and parents signing into school portals (ENT).
- [FranceConnect](https://www.authdog.com/docs/connectors/franceconnect.md): French government identity aggregator; lets parents authenticate through trusted public accounts.
- [ARENA / AAF](https://www.authdog.com/docs/connectors/arena-aaf.md): SAML identity provider for teachers, administrators, and education staff managed by regional academies.
- [RENATER](https://www.authdog.com/docs/connectors/renater.md): SAML federation for higher education and research institutions across France (Fédération Éducation-Recherche).

## Framework SDKs

- [Next.js](https://www.authdog.com/docs/frameworks/nextjs.md): App Router callback exchange and client identity integration.
- [Next.js quickstart](https://www.authdog.com/docs/quickstarts/nextjs.md): Five-minute path to a first sign-in.
- [React Elements](https://www.authdog.com/docs/frameworks/react.md): Presentational identity components for React applications.
- [React Elements quickstart](https://www.authdog.com/docs/quickstarts/react.md): Five-minute path to a first sign-in.
- [Remix](https://www.authdog.com/docs/frameworks/remix.md): Loaders, actions, and session handling.
- [React Native / Expo](https://www.authdog.com/docs/frameworks/expo.md): Mobile sign-in flows with deep links and secure storage.
- [SvelteKit](https://www.authdog.com/docs/frameworks/sveltekit.md): Hooks, load functions, and form actions.
- [TanStack Start](https://www.authdog.com/docs/frameworks/tanstack-start.md): Full-stack React with server functions and streaming.
- [Vue](https://www.authdog.com/docs/frameworks/vue.md): Composables and client integration for Vue 3 applications.
- [Angular](https://www.authdog.com/docs/frameworks/angular.md): Guards, interceptors, and standalone providers.
- [Astro](https://www.authdog.com/docs/frameworks/astro.md): Middleware and endpoints for content-first sites.
- [Gatsby](https://www.authdog.com/docs/frameworks/gatsby.md): Static and hybrid sites with auth at edge.
- [RedwoodJS](https://www.authdog.com/docs/frameworks/redwood.md): Full-stack Jamstack with Authdog-backed identity.
- [Nuxt](https://www.authdog.com/docs/frameworks/nuxt.md): Session state and composables for Nuxt apps.
- [Solid](https://www.authdog.com/docs/frameworks/solid.md): Provider and primitives for SolidJS applications.
- [React Router](https://www.authdog.com/docs/frameworks/react-router.md): Session handling for React Router applications.
- [JavaScript](https://www.authdog.com/docs/frameworks/javascript.md): Framework-free browser client for any web app.

## Backend SDKs

- [Express](https://www.authdog.com/docs/backend/express.md): Middleware and route guards for Express apps.
- [Express quickstart](https://www.authdog.com/docs/quickstarts/express.md): Five-minute path to a first protected route.
- [Fastify](https://www.authdog.com/docs/backend/fastify.md): Plugins and hooks for Fastify runtime.
- [FastAPI](https://www.authdog.com/docs/backend/fastapi.md): Dependencies for session context and a 401 require_auth gate.
- [FastAPI quickstart](https://www.authdog.com/docs/quickstarts/fastapi.md): Five-minute path to a first protected route.
- [Django](https://www.authdog.com/docs/backend/django.md): Middleware plus a require_auth view decorator.
- [Django quickstart](https://www.authdog.com/docs/quickstarts/django.md): Five-minute path to a first protected route.
- [Flask](https://www.authdog.com/docs/backend/flask.md): Session on flask.g and a require_auth decorator.
- [Flask quickstart](https://www.authdog.com/docs/quickstarts/flask.md): Five-minute path to a first protected route.
- [Starlette](https://www.authdog.com/docs/backend/starlette.md): ASGI middleware and async require_auth for pure Starlette.
- [Starlette quickstart](https://www.authdog.com/docs/quickstarts/starlette.md): Five-minute path to a first protected route.
- [aiohttp](https://www.authdog.com/docs/backend/aiohttp.md): Middleware and a require_auth wrapper for aiohttp handlers.
- [aiohttp quickstart](https://www.authdog.com/docs/quickstarts/aiohttp.md): Five-minute path to a first protected route.
- [Go](https://www.authdog.com/docs/backend/go.md): Middleware and service-to-service auth.
- [Go quickstart](https://www.authdog.com/docs/quickstarts/go.md): Five-minute path to a first protected route.
- [Rust](https://www.authdog.com/docs/backend/rust.md): Axum, Actix Web, Rocket, Warp, and Poem integrations.
- [Hono](https://www.authdog.com/docs/backend/hono.md): Middleware and auth gate for Hono on Bun, Node.js, Workers, and Deno.
- [Elysia](https://www.authdog.com/docs/backend/elysia.md): Plugin and auth guard for Elysia on Bun.
- [Koa](https://www.authdog.com/docs/backend/koa.md): Middleware and auth gate for Koa apps.
- [Kotlin](https://www.authdog.com/docs/backend/kotlin.md): Session resolution and auth gate for Ktor servers.

## Language SDKs

- [Python SDK](https://www.authdog.com/docs/sdks/python.md): authdog 0.1.1 on PyPI: management client and userinfo.
- [Node.js SDK](https://www.authdog.com/docs/sdks/node.md): @authdog/node-sdk 0.2.0 in authdog/sdk. Not on the public npm registry.
- [Go SDK](https://www.authdog.com/docs/sdks/go.md): github.com/authdog/go-sdk in the authdog/sdk monorepo. Go 1.21+.
- [Rust SDK](https://www.authdog.com/docs/sdks/rust.md): authdog 0.2.0 crate in authdog/sdk. Not on crates.io.
- [Java SDK](https://www.authdog.com/docs/sdks/java.md): com.authdog:authdog-java-sdk 0.2.0. Java 11+. Not on Maven Central.
- [C# SDK](https://www.authdog.com/docs/sdks/csharp.md): Authdog.Sdk 0.2.0 for .NET 8. Not on NuGet.
- [Zig SDK](https://www.authdog.com/docs/sdks/zig.md): authdog 0.1.0: stdlib-only management client and userinfo.

## Examples

- [Examples](https://www.authdog.com/docs/examples): Runnable app for each framework.
- [Team dashboard](https://www.authdog.com/docs/examples/nextjs.md): Next.js. Project status for the signed-in member. Billing, Mobile, and Docs render only after userinfo accepts the session.
- [Customer navbar](https://www.authdog.com/docs/examples/react.md): React Elements. Shop catalog under a navbar that opens hosted sign-in. Orders stay on a server app that holds the session.
- [Support inbox](https://www.authdog.com/docs/examples/remix.md): Remix. Customer tickets on /inbox. The loader redirects anonymous agents before the list renders.
- [Field companion](https://www.authdog.com/docs/examples/expo.md): React Native / Expo. Today's site visits after a deep-link return. The job list renders only after userinfo accepts the token in secure storage.
- [Member site](https://www.authdog.com/docs/examples/sveltekit.md): SvelteKit. Public home, member library on /library. getUser redirects anonymous readers before the guides load.
- [Ops console](https://www.authdog.com/docs/examples/tanstack-start.md): TanStack Start. Open incidents for the on-call operator. Anonymous visitors see the sign-in link and no incident rows.
- [Workspace settings](https://www.authdog.com/docs/examples/vue.md): Vue. Workspace name, timezone, and join notification after hosted sign-in. The fields stay hidden until userinfo returns a user.
- [Admin console](https://www.authdog.com/docs/examples/angular.md): Angular. Team directory on /directory. The route guard keeps the list off screen until fetchUser returns a user.
- [Handbook](https://www.authdog.com/docs/examples/astro.md): Astro. Public chapters on the home page. Member chapters on /handbook load only after getUser accepts the session.
- [Resource library](https://www.authdog.com/docs/examples/gatsby.md): Gatsby. Titles on the public page. GET /api/files returns the board pack and runbook only after requireAuth.
- [Job board](https://www.authdog.com/docs/examples/redwood.md): RedwoodJS. Listings stay public. The applications function returns candidates only after requireAuth.
- [Orders API](https://www.authdog.com/docs/examples/express.md): Express. GET /orders returns open orders for the signed-in clerk and 401 for everyone else.
- [Inventory API](https://www.authdog.com/docs/examples/fastify.md): Fastify. GET /skus returns on-hand stock for the signed-in clerk and 401 for everyone else.
- [Booking API](https://www.authdog.com/docs/examples/fastapi.md): FastAPI. GET /bookings returns room reservations. Routes without a session return 401.
- [Clinic portal](https://www.authdog.com/docs/examples/django.md): Django. GET /appointments returns today's clinic slots. Anonymous callers are rejected.
- [Status board](https://www.authdog.com/docs/examples/flask.md): Flask. GET / publishes component state. GET /notes returns the internal timeline only with a session.
- [Intake service](https://www.authdog.com/docs/examples/starlette.md): Starlette. GET /intakes returns the waiting queue. Anonymous callers are rejected.
- [Event ingest](https://www.authdog.com/docs/examples/aiohttp.md): aiohttp. GET /events returns recent door and check-in events. Handlers without a session are rejected.
- [Billing service](https://www.authdog.com/docs/examples/go.md): Go. GET /invoices returns open and paid invoices. Gin returns 401 unless Authdog authenticates the caller.
- [Policy service](https://www.authdog.com/docs/examples/rust.md): Rust. GET /policies returns shipping and refund rules. The Axum gate returns 401 without a session.

## Site

- [Docs overview](https://www.authdog.com/docs): Start here for concepts, guides, and the SDK indexes.
- [API reference](https://www.authdog.com/docs/api.md): HTTP API reference for Authdog services.
- [Securing your app](https://www.authdog.com/docs/security.md): Map common threats to the Authdog controls that stop them.
- [Web SDK](https://www.authdog.com/product/web-sdk): Framework SDK overview and package index.
- [Pricing](https://www.authdog.com/pricing): Plans and usage.
- [Console](https://console.authdog.com): Manage tenants, projects, environments, and users.

## Optional

- [Full documentation](https://www.authdog.com/llms-full.txt): Every linked Markdown document in one file.
- [Changelog](https://www.authdog.com/changelog): Product release notes.
- [GitHub](https://github.com/authdog): Open-source SDKs and tooling.
- [Status](https://status.authdog.com): Service availability.
- [Sitemap](https://www.authdog.com/sitemap.xml): Full URL index for crawlers.