Enterprise Security. Zero Identity Tax.
Stop paying punishing per-user fees to external Identity Providers. Aeion Auth provides a unified, enterprise-grade identity layer with SSO (SAML 2.0 + OIDC + 10 OAuth providers), SCIM 2.0 directory sync, MFA (TOTP + WebAuthn hardware keys via Bridge — YubiKey/Titan/Feitian/Ledger/Nitrokey), magic links, granular RBAC, and immutable audit logging — built directly into the core of your operating system. PIV/CAC smart-card sign-in supported for federal deployments.
A Unified Identity Foundation
Enterprise SSO
Your team signs in with the company login they already have. SAML 2.0 (Okta, Microsoft Entra ID, OneLogin, Ping) plus OAuth 2.0 + OIDC + PKCE and 10 built-in providers: Google · GitHub · Microsoft · Apple · Facebook · Twitter / X · LinkedIn · Discord · Slack · generic OIDC. Encrypted state cookies, PKCE code verifiers in Redis, JWKS-signed JWT verification, SAML assertion signature checks.
Automated User Lifecycle (SCIM 2.0)
When someone joins your company they get an Aeion account automatically; when they leave, access is revoked the moment IT disables them in your directory. No manual user management, no forgotten ex-employee accounts. Full SCIM 2.0 Users + Groups + Bulk, with directory-driven role mapping.
Multi-Factor Authentication
TOTP (RFC 4226/6238) via any authenticator app + WebAuthn FIDO2 for hardware keys (YubiKey, Touch ID, Face ID). Backup codes, ±1 window tolerance for clock drift, encrypted secrets at rest.
Passwordless Magic Links
Eliminate password fatigue. Send secure, single-use, dynamically-hashed magic links that authenticate users in one click. 15-minute expiry, reliably queued with automatic retry for delivery.
Granular RBAC
Hierarchical roles with module-level permissions that cascade across every Aeion module. Control exactly who can view, edit, or delete specific collections — enforced at the database query layer, not just the UI.
Immutable Audit Logging
Every login, MFA setup, role change, and authorization failure logged to an append-only security ledger. 90-day retention by default, exportable for SOC 2 / HIPAA / ISO 27001 evidence.
API Key Management
Scoped API keys with per-key rate limits, IP allowlists, automatic rotation, and per-call audit trail. Generate, rotate, and revoke programmatically via the admin UI or MCP tools.
What Ships in Aeion Auth
OAuth / OIDC
9 built-in providers plus generic OIDC, with PKCE, encrypted state/token storage, and JWKS-signed JWT verification — the full modern OAuth security checklist handled for you, not left as an integration exercise.
WebAuthn / FIDO2 (via Bridge)
Hardware-key enrollment and verification for YubiKey, Touch ID, Face ID, Windows Hello, and platform authenticators — phishing-resistant by construction, because the credential is cryptographically bound to your domain, not just a code someone could be tricked into repeating.
Login History
Every attempt logged with IP geolocation and device fingerprint, with suspicious-login detection (impossible-travel, new device, password spray) flagging the sign-ins that deserve a second look before they become an incident.
MFA
Standards-compliant TOTP (RFC 4226/6238) with backup codes and encrypted secret storage — works with any authenticator app your users already have installed.
API Keys
The full key shown once at creation, a hash stored forever after — scoped permissions, IP allowlists, per-key rate limits, and an immutable usage log mean a leaked key does exactly as much damage as you scoped it to, and no more.
Magic Links
Passwordless sign-in via encrypted, single-use email links that expire in 15 minutes — no password to forget, phish, or reuse across sites.
Password Reset
Every completed reset revokes existing sessions automatically, so a compromised password stops working the moment it's changed.
Invitations + Role Assignment
Multi-tenant invitations stay in sync with billing automatically — a canceled subscription demotes access without anyone having to remember to do it manually.
Reliable Delivery Queue
Magic-link and password-reset emails are queued with deduplication and automatic retry, so a transient delivery hiccup never leaves a user stuck outside their own account.
MFA — TOTP + WebAuthn Hardware Keys
Two factors, real cryptography, zero dependency on an external IdP.
Enterprise SSO — SAML 2.0 + OIDC + 10 Native OAuth Providers
Aeion handles the full single-sign-on matrix without third-party libraries — your people use the identity provider you already run.
Directory Sync (SCIM 2.0) — Onboarding & Offboarding on Autopilot
The single biggest source of security risk in most companies is the ex-employee account nobody remembered to turn off. SCIM 2.0 closes that gap.
PIV / CAC Smart-Card Sign-In (Federal & Defense)
Government and defense customers can sign in with the physical smart-card their staff already carry (PIV for civilian agencies, CAC for DoD).
API Keys + Audit Trail
Programmatic access without exposing user credentials. Generate a scoped key with a name, granted permissions, an optional IP allowlist, a rate limit, and an optional expiry — the full key is shown exactly once at creation; only a secure hash is ever stored.
Native Auth Web Portals
Hosted Login & Signup
Lazy-loaded login, registration, and password recovery portals on your Next.js frontend with unified `getSession()` access.
Customer Account Dashboard
A dedicated `/portal/settings` member area where users manage MFA devices, active sessions, API keys, security settings, and notification preferences (per-channel × delivery-method, quiet hours, daily/weekly digest) — all self-service, no support ticket.
Self-Service MFA Enrollment
Users enroll TOTP or hardware keys without IT assistance. Admins can mandate MFA per role with a single config flag.
Concurrent Session Limits
Cap active sessions per user (e.g., 3 devices max). Newer logins evict oldest sessions with audit-logged kick events.
Built for Modern Threats
Redis-Backed State
CSRF tokens, PKCE verifiers, and session state stored in Redis — survives process restarts, scales infinitely across API clusters.
Rate Limiting & Brute-Force Defense
Native throttling prevents credential stuffing and enumeration. Per-IP + per-account budgets with progressive backoff.
Account Lockout
N failed attempts → temporary lockout with exponential cooldown. Every attempt is recorded to the audit trail for forensics.
Session Hijacking Defense
Instant session revocation, strict JWT token rotation on every refresh, anomaly detection on User-Agent + IP changes.
Zero-Trust Perimeter
Every API route and database query enforces role-based checks natively at the data layer — not just at the UI.
Encrypted Secrets at Rest
MFA secrets, OAuth refresh tokens, API key hashes all stored with AES-256 encryption. Plaintext never persisted.
CISO / IAM-buyer questions
Those are hosted SaaS sitting outside your stack. You pay per MAU ($4-12K/year for moderate B2B), suffer API latency, and your user identity data lives in their database. Aeion Auth runs *inside* your OS — same database, same audit log, same request pipeline as every other module. Identity is a row in your tenant, not a webhook to a vendor.
Yes. Aeion supports both SAML 2.0 and OIDC/OAuth, so your customers' Google Workspace / Microsoft Entra / Okta / OneLogin / Ping / Auth0 users sign in with their existing credentials — Aeion is the SP (service provider), their IdP is unchanged. SCIM 2.0 keeps the user list in sync automatically (auto-provision on join, auto-revoke on offboard).
Full WebAuthn 2.0 support via the Bridge appliance. YubiKey, Touch ID, Face ID, Windows Hello, and platform authenticators all work. Hardware key enrollment is phishing-resistant by construction — the credential is cryptographically bound to your domain.
Append-only by schema (no UPDATE/DELETE allowed). Records every login, MFA setup, role change, permission grant/revoke, API key creation, and authorization failure. Meets SOC 2 CC6.1 (logical access logging), CC7.2 (system monitoring), HIPAA 164.312(b) (audit controls), ISO 27001 A.9.4.2 (secure logon). SIEM export is on the roadmap.
No. Auth is included free with every Aeion module regardless of active-user count — no soft-lock, no feature degradation, no surprise rate-limiting in the middle of a launch.
Yes, on every deployment. Set `requireMfa: true` on the role definition; users with that role cannot complete login without enrolled MFA. Combine with hardware-key-only policy for admin roles.
Per-IP rate limiting + per-account exponential backoff. 5 failures in 5 minutes → 1-minute lockout. 20 failures in 1 hour → 1-hour lockout. Every attempt is recorded to the login history log with its IP, user-agent, and reason. Configurable per tenant.
Aeion integrates the Have I Been Pwned API on password set + reset. New passwords checked against the breach corpus; matched passwords rejected. Existing passwords flagged on next login with forced reset prompt.
Aeion Auth — Deep Dives
[Pricing](/platform/auth/pricing)
$0, included free with every module — no per-MAU, no per-connection fee.
[Architecture](/platform/auth/architecture)
End-to-end OAuth flow, hybrid JWT + Redis-refresh session model, RBAC enforcement.
[Security](/platform/auth/security)
AES-256-GCM encryption per data class, RFC 4226/6238/7636 standards, SOC 2 + ISO 27001 + HIPAA + GDPR mapping.
[Providers Catalog](/platform/auth/providers-catalog)
All 10 OAuth providers with real endpoint URLs, default scopes, env-var config keys.
[Tech Specs](/platform/auth/tech-specs)
Module inventory + system metrics.
Compare vs Identity Brokers
[vs Auth0](/platform/auth/competitive/vs-auth0)
The original Auth0 alternative comparison.
[vs Okta](/platform/auth/competitive/vs-auth0-okta)
Okta + Auth0 combined comparison.
[vs WorkOS](/platform/auth/competitive/vs-workos)
Per-MAU + per-connection identity-tax math at 50+ customer-tenants.
Integration Walkthroughs
[Google](/platform/auth/integrations/google)
Consumer + Workspace, HD domain restriction.
[Microsoft (Entra ID)](/platform/auth/integrations/microsoft)
Work / school accounts, multi-tenant or single-tenant restriction.
[GitHub](/platform/auth/integrations/github)
Developer audiences, the email-not-returned-by-default quirk handled, GitHub Enterprise Server support.
[Apple](/platform/auth/integrations/apple)
App Store guideline 4.8 compliance, id_token-only flow, private email relay.
[Slack](/platform/auth/integrations/slack)
Workspace SSO, App Manifest, upgrade path to bot capabilities for Notifications module.
[Generic OIDC](/platform/auth/integrations/oidc)
Federate from Okta / Auth0 / Ping / OneLogin / JumpCloud / Keycloak / Authentik / ZITADEL.
Use Cases by Industry / Vertical
[B2B SaaS](/platform/auth/use-cases/b2b-saas)
Per-customer-tenant federation, scale math at 50+ tenants, SOC 2 evidence.
[E-commerce](/platform/auth/use-cases/e-commerce)
Social login, magic links, risk scoring as fraud signal, guest-to-registered migration.
[Healthcare](/platform/auth/use-cases/healthcare)
HIPAA Security Rule § 164.308 + § 164.312 mapping, WebAuthn for clinical workstations.
[Fintech](/platform/auth/use-cases/fintech)
PCI DSS Section 8 + 10, SOX segregation of duties, PSD2 Strong Customer Authentication.
[GovTech](/platform/auth/use-cases/govtech)
NIST SP 800-53 AC family, FedRAMP AU controls, air-gapped deployment, PIV/CAC smart-card sign-in.