Skip to content
AUTHENTICATION

Every way your users sign in — done right.

Password, passkey and multi-factor sign-in — prebuilt, accessible, and yours to drop in, with magic links and social OAuth switching on at launch. Configure a template, theme it to your brand, ship it before lunch.

What you get

Passkeys, first-class

Phishing-resistant WebAuthn sign-in with a graceful password fallback. No SMS, no shared secrets.

Passwordless & social

Magic links, 6-digit codes, and Google / GitHub / Apple OAuth — switching on at launch, configurable per app.

MFA & recovery codes

TOTP authenticator enrollment with reveal-once backup codes — enforced at sign-in, not suggested.

Sessions you control

Short-lived tokens, refresh rotation with reuse detection, per-user session list, one-click revoke.

Abuse protection

Rate limits, breach-password checks and bot defenses — on by default, no tuning.

Appearance API

~15 semantic variables restyle the whole component to match your brand without forking it.

One line in your layout. A complete sign-in.

Wrap your app in <AdetioProvider /> and render <SignIn />. You get a styled, accessible, branded form — and a session you can read anywhere.

Open the live demo
// app/layout.tsx
import { AdetioProvider } from '@adetio/nextjs'
export default function RootLayout({ children }) {
return (
<AdetioProvider>
<html lang="en"><body>{children}</body></html>
</AdetioProvider>
)
}
// app/sign-in/page.tsx
import { SignIn } from '@adetio/nextjs'
export default function Page() {
return <SignIn redirectUrl="/dashboard" />
}
UNDER THE HOOD

What actually happens on a sign-in.

01

Prove it’s really them

A password, a passkey with user verification, or a second factor — with breach-password and bot checks running before any account is touched.

02

Mint a session worth trusting

A short-lived token bound to your tenant, plus a single-use rotating refresh token. If a stolen refresh token is ever replayed, the reuse is detected and the whole session family is revoked.

03

Stay in control afterwards

Every session is listed per user and revocable in one click. Sensitive changes — new factors, key rotation, deletions — demand a fresh re-proof of identity first.

THE DETAILS

Security answers, before your review asks.

The properties below are how the platform is built — each one is testable against the API.

Replay-guarded MFA

TOTP codes are single-use; a code that just succeeded is rejected if replayed. Recovery codes burn on use.

No enumeration, anywhere

Sign-in, password reset and passkey endpoints answer uniformly whether an account exists or not — reset requests answer in constant time.

Breach-checked passwords

Signup checks candidate passwords against known breaches via k-anonymity — only a 5-character hash prefix ever leaves the platform, never the password.

MFA an org can force

When an organization requires MFA, a user without a second factor gets a session that can only enroll one. A capability limit, not a banner.

Step-up re-authentication

Dangerous operations re-prove the account’s real factor — TOTP or recovery code for authenticator accounts, a passkey assertion for passkey accounts.

Hardened session cookies

httpOnly __Host- cookies, strict same-origin checks on every mutating request, and a locked-down content-security policy.

WHERE THINGS STAND

Live today — and what switches on at launch.

Email + password sign-in, sign-up & reset
Live today
Passkeys / WebAuthn
registration + passwordless sign-in
Live today
TOTP MFA + recovery codes
Live today
Org-forced MFA & step-up re-auth
Live today
Magic links & email codes
At launch
Social OAuth — Google, GitHub, Apple
At launch
European eID sign-in
per-country enablement
At launch

The same rule as everywhere on this site: what is done says done, what is planned says planned.

Bring your users home to Europe.

Built and tested, in closed hardening before public launch. The waitlist gets access first.