Passwordless sign-in on your own domain, with user data stored in Canada

Your app sends people to the sign-in page on a hostname you own, such as login.acme.ca. They sign in, and HonkIO sends them back to your app with standard OpenID Connect tokens.

Authorization code with PKCE, ID tokens, userinfo, JWKS, discovery and logout, so any OIDC library works. The quickstarts cover Next.js, Express, FastAPI, Django and Laravel.

HonkIO keeps each app's user directory: profiles, sessions and sign-in history, and on Business, organizations with roles and invitations. Manage it in the dashboard or through the management API, and get webhooks when it changes.

• Next.js quickstart
• Express quickstart
• FastAPI and Django quickstart
• Laravel quickstart

• Email code or one-tap link, on every plan. Codes are single use, expire after 10 minutes and are stored only as a hash.
• Text-message codes, on Pro and Business. Sent to Canadian mobile numbers from your own HonkIO number, at the normal SMS rate.
• Passkeys, on every plan: Face ID, Touch ID, Windows Hello, Android or a security key. After a code sign-in, the page offers to save one.
• The hosted page is in English and French, with your logo, brand colour and app name.

• Every app, test apps included, runs on a subdomain you own. You publish a TXT record and a CNAME, and HonkIO gets the HTTPS certificate.
• The issuer is your own hostname, so you can later run sign-in elsewhere on that same hostname.
• Export all of an app's users, organizations and roles as a file at any time.
• Passkeys are tied to your domain by default, so users can keep them if a later provider runs sign-in on that domain.

• An invisible proof-of-work check on every sign-in and sign-up, run by HonkIO itself. No third-party CAPTCHA, and no visitor data sent to one.
• Throwaway email providers blocked by default, and per-app blocklists for addresses, domains, numbers, IP ranges and countries.
• A daily text spending limit per app, $5.00 by default, and texts paused when they look like SMS pumping.
• Attack mode when sign-ups or codes spike: every visitor gets a challenge and text sign-in pauses until traffic is back to normal.
• New-device alerts with a link that ends every session if the sign-in was not the user.
• Users flagged as likely bots do not count toward your plan.

• Two-step verification on Pro and Business: a passkey, or a code on the channel the user did not sign in with. Require it for an app, and on Business for an organization or a role.
• Organizations on Business: members with one role each, invitations, and the organization the user signed in to carried in the tokens.

Your users' data is stored in Canada: the database and cache are in Montréal, and sign-in emails are sent through AWS in Montréal (ca-central-1).

Requests are processed on US-hosted infrastructure (Railway, US East), and Cloudflare handles connections to your sign-in hostname as a processor. So we say the data is stored in Canada, not that it never leaves Canada.

Abuse data, such as IP addresses, device cookies and risk scores, is kept for 90 days and then deleted or reduced to counts.

A user counts in a month only if they sign in on a day after they signed up, and likely bots never count. Sign-in emails and texts cost the normal message rates, without the verification fee. A billing problem never locks existing users out: they keep signing in by email and passkey.

Do I need my own domain?

Yes. Every app runs on a subdomain you own, such as login.acme.ca; there is no shared HonkIO sign-in domain. You add a TXT record and a CNAME, and HonkIO gets the certificate. Apex domains are not accepted.

Which libraries and frameworks work with it?

Any OpenID Connect library that supports the authorization code flow with PKCE, such as openid-client, Auth.js, Authlib or Socialite. The docs have quickstarts for Next.js, Express, FastAPI, Django and Laravel.

Does it support passwords or social login?

No. People sign in with an email code or link, a text-message code or a passkey.

What happens to signed-in users if HonkIO is unreachable?

Your app keeps a session when a token refresh cannot reach HonkIO, for up to 24 hours past the access token's expiry, and ends it at once if the refresh is refused. The quickstarts implement this rule.

Can I move to another provider later?

Yes. Export every user, organization and role at any time, and because the issuer is your own hostname, you can run sign-in elsewhere on that hostname. Passkeys cannot be exported, by design; users keep them if your next provider runs sign-in on the same domain.

Where is my users' data stored?

In Canada, in Montréal. Requests are processed on US-hosted infrastructure, and Cloudflare handles connections to your sign-in hostname as a processor.

Is there a free plan?

Yes. Free covers 250 users a month on one live app, with email codes and links, passkeys, webhooks and every abuse protection. Test apps are free on every account.

• HonkIO Auth comparisons

  HonkIO Auth compared with Auth0, Clerk, Amazon Cognito, Firebase Authentication and Stytch on data location, plans and sign-in methods.

• HonkIO Auth vs Auth0

  HonkIO Auth and Auth0 side by side: Canada data regions, plans, custom domains, passkeys, MFA and organizations.

• HonkIO Auth vs Clerk

  HonkIO Auth and Clerk side by side: where user data is stored, free and paid plans, passkeys, texts and organizations.

• Verify

  One-time codes by text message, to confirm that a Canadian phone number belongs to your user.

• SMS API

  Send and receive SMS with Canadian local and toll-free numbers, with CASL consent and STOP replies enforced in the API.