Login for your app.
Move to it in one line.
Keep the better-auth client you already ship. Point it at Signet. Your users, sessions and secrets are rows in a Postgres that is yours. Leaving is a pg_dump.
Hobby is free. Team is $299 a month: unlimited users, unlimited SSO.
Built by Herman Geldenhuys in Montreal. Our own console signs in through Signet.
import { createAuthClient } from "better-auth/client"
export const auth = createAuthClient({
- baseURL: "https://old.example.com",
+ baseURL: "https://auth.yourco.com",
})Compatibility recorded 2026-07-22 against the better-auth reference. The receipt.
People, services, and agents. One place to switch any of them off.
| Who signs in | What they hold | How they arrive | How you cut them off |
|---|---|---|---|
| People | a session | email, passkey, SSO | revoke |
| Services | a token | minted once | revoke |
| Agents | a scoped token | MCP auth | revoke |
Your Postgres. Nothing phones home.
Your users are rows in a database dedicated to you. That does not change at renewal.
| Move | What it means |
|---|---|
| Dump | Users, sessions and secrets are ordinary PostgreSQL rows in a database dedicated to you. Nothing about the format is ours. |
| Leave | Leaving is a pg_dump. Hosted, we hand you the dump. On your metal, you run it yourself. Restore it. Boot. |
| Same build | An enterprise licence runs the same software we host, so your app's code does not change. |
No compliance certification is claimed. Hosted signup provisions the instance. On-prem is a licence, not a free download. Every compatibility check we run is published, with the date it ran.
Read the compatibility receiptChange one URL.
The stock client keeps working. Point its baseURL at a Signet instance. The code you ship does not change. Compatibility recorded 2026-07-22.
Holding live users? The cutover is a written runbook: user rows, password hashes and live sessions copy across. Nobody resets a password. If you roll back, every pre-cutover session is still valid.
// your existing better-auth client
- baseURL: "https://your-current-auth.example.com"
+ baseURL: "https://auth.yourcompany.com"
// every call you already wrote keeps workingWhat ships today.
All of this works today. Two things are not finished: SAML SSO is proven against a conformance identity provider but not yet against the commercial ones, and the OAuth provider surface ships its core flow only. The full ledger is on the product page.
$299 a month. Same bill.
One enterprise customer or forty. Unlimited users and unlimited enterprise SSO connections are included. The next deal adds revenue, not a line item. Most vendors bill SSO per connection. Signet does not. The price is effective 2026-08-07.
Enterprise, with air-gap and a named contract, is quoted. The vendor pack is what your reviewer attaches.