Drop-in authentication
your users can trust.
AuthLock is embeddable auth for your web apps. One script tag adds sign-up, login, MFA and passwordless — with single sign-on across all your sites and signed webhooks your backend can trust.
No credit card · Sandbox & production out of the box · Self-hostable
Everything you need to sign users in.
The parts of auth that are easy to get wrong, handled — so you can get back to your product.
One script tag
Add a single <script> to your site and AuthLock renders a secure sign-up and login widget in an iframe. No auth code to write, review, or maintain.
Single sign-on
End-users are one global identity. Someone signed in on one of your sites can join the next with a single tap — real SSO across everything you ship.
MFA & passwordless
Email/password, magic links, one-time codes, TOTP, SMS and email second factors — turn each on per widget, optional or enforced.
Sign in with your phone
The AuthLock Authenticator app approves logins by QR or push. With biometrics on the device, it safely skips MFA — possession plus your face or fingerprint.
Three steps to shipped.
- 01
Create a project
Spin up sandbox and production environments, each with its own keys, domains and webhook endpoint.
- 02
Drop in the widget
Paste one script tag. Pick your sign-in methods — password, OTP, magic link, QR — visually per widget.
- 03
Listen for webhooks
Your backend gets a signed event on every sign-up and login. Verify the HMAC and you own the session.
<!-- Add sign-in to any page -->
<script src="https://app.authlock.com/widget.js" async
data-authlock-key="alk_pk_live_…"
data-pane="pane_…"></script>
// Your backend — trust the webhook, not the browser
app.post("/webhooks/authlock", (req, res) => {
const ok = verify(req.rawBody,
req.headers["authlock-signature"], SECRET)
if (ok) grantSession(req.body.data.user)
})A REST API and webhooks, not a black box.
Copy-paste receiver examples in Node, PHP, Python, Go and Ruby. Manage users and roles from the dashboard or over a secret-key API. Every integration detail is one tab away.
- Signed webhooks for every user lifecycle event
- Secret-key REST API scoped per environment
- Roles, blocking, password resets — UI or API
Log in by scanning. Or don't even scan.
The AuthLock app shows your one-time codes and approves logins with a tap. Scan a QR on the sign-in screen, or hit “Open your AuthLock app” and approve the push. Protected by your device's biometrics, it safely skips MFA — because possession plus your fingerprint already is two factors.
Biometric approval bypasses MFA
Secure by default. Not by checklist.
AuthLock ships the hard security decisions already made — the same ones teams spend months getting wrong. Two independent adversarial reviews, and every finding fixed.
- Field-level encryption at rest with blind indexes
- Proof-of-work captcha + per-tenant rate limiting
- HMAC-signed webhooks, SSRF-guarded delivery
- Verify-first signup, enumeration-safe everywhere
- Opaque, hashed sessions with per-site revocation
- Self-hostable — your data stays in your database
“We deleted our entire auth service and replaced it with one script tag. SSO across our three products just… worked.”
Ship auth today.
Create a free project, drop in the widget, and watch the first webhook land. No credit card required.