HonkIO Auth: sign-in for your app, on your own domain

HonkIO started with texts and added email. From today it also signs your users in. HonkIO Auth is a hosted sign-in page and user directory that runs on a hostname you own, such as login.acme.ca, and it is open to every HonkIO account.

Your app sends people to the sign-in page. They sign in with an email code or link, a passkey, or a text-message code, and HonkIO sends them back to your app, signed in. There are no passwords to store, reset or leak, and no social logins.

Standard OpenID Connect

The sign-in page is a standard OpenID Connect provider: authorization code with PKCE, ID tokens, userinfo, JWKS, discovery and logout. Any OIDC library works. The quickstarts cover Next.js, Express, FastAPI, Django and Laravel.

Because the issuer is your own hostname, your users never see a HonkIO address in their browser, and you are not locked in. You can export every user, organization and role at any time, and later run sign-in somewhere else on that same hostname.

How people sign in

• Email code or link, on every plan: a 6-digit code and a one-tap link that only finishes sign-in in the browser that asked for it, so mail scanners cannot use it up
• Passkeys, on every plan: Face ID, Touch ID, Windows Hello, Android or a security key, with the page offering to save one after a code sign-in
• Text-message codes, on Pro and Business: sent from your own HonkIO number, never a shared one, to Canadian mobile numbers

You choose the logo, the brand colour, the app name and which methods are on. The page is in English and French, follows the browser’s language and has an EN/FR toggle. Abuse protection is included on every plan: rate limits, lockouts after wrong codes, risk checks and new-device alerts. No third-party CAPTCHA is involved.

A user directory you can manage

HonkIO keeps each app’s users, profiles, sessions and sign-in history. Manage them in the dashboard’s Auth section or through the management API, and get webhooks when they change. Pro adds two-step verification. Business adds organizations, roles and invitations, with two-step required per organization or role.

Pricing in CAD, from the balance you already have

Plans are per app, per month, and come out of the same prepaid balance as your texts and email:

• Free: $0, up to 250 users, one live Free app per account
• Pro: $49, 2,500 users included, then $0.025 per user
• Business: $249, 10,000 users included, then $0.02 per user

A user counts only in a month when they sign in on a day after the one they signed up, so people who sign up once and leave, and likely bots, cost nothing. Sign-in emails and texts cost HonkIO’s normal per-message rates, without the verification fee, and passkey sign-ins are free. The Auth plans page has the details, including the grace period if your balance runs out.

Where the data lives

Your users’ data is stored in Canada. Requests are processed on US-hosted infrastructure, and Cloudflare handles connections to your sign-in hostname as a processor. Sign-in email is sent from Montréal. The data location page spells out each part, and the hosted page links to a short version of it for your users.

Try it with a test app

Test apps are free and unlimited, get every paid feature, send nothing real and are capped at 100 users. Create one with a test key that has the auth_apps permission (existing keys don’t gain it, so create or edit one):

curl -X POST https://api.honkio.ca/v1/auth-apps \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "hostname": "login-dev.acme.ca",
    "name": "Acme",
    "redirect_uris": ["http://localhost:3000/auth/callback"],
    "post_logout_redirect_uris": ["http://localhost:3000/"]
  }'
# The response holds client_id, client_secret (shown once) and dns_records.

Publish the two DNS records the response lists, then verify the domain. HonkIO gets the HTTPS certificate once they check out:

; At your DNS host, for login.acme.ca
_honkio-auth.login.acme.ca.  TXT    "honkio-auth=<the token from dns_records>"
login.acme.ca.               CNAME  edge.signin.honkio.ca.

Then point your OIDC library at https://login-dev.acme.ca with the client ID and secret. On a test app, sign in as any address at test.honkio.ca with the code 000000. Start at honkio.ca/docs/auth, or follow the Next.js quickstart. Questions are welcome through the contact page.