Introduction

What LoginWith is and when to reach for it.

LoginWith is SSO infrastructure shaped like HTML. One script tag loads the SDK, one button signs users in — PKCE, tokens and refresh included, without any extra plumbing.

It is a standard OAuth 2.1 and OpenID Connect authorization server, so every language and framework you already use works. LoginWith runs the sign-in — social providers, passwords, magic links, second factors — and your app just consumes the resulting bearer token.

What LoginWith handles

• Sign-in methods, chosen per page: SSO with Google, GitHub, GitLab, Microsoft, LinkedIn, X, Meta and Apple; email and password; magic links
• MFA — authenticator apps (TOTP), passkeys, security keys, email and SMS codes, recovery codes — with the assurance reached stamped on the token as amr and acr
• PKCE, the authorization code flow, rotating refresh tokens and revocation
• Signed tokens — RS256 JWTs, verifiable against a key set published per org
• Branded login pages at <your-slug>.loginwith.page, or on your own domain, with no frontend code
• Tenants — group your users into teams or workspaces inside one org, open by email domain, Google Workspace, invitation, or to everyone

What LoginWith does not do

• Host your app or its data
• SCIM provisioning
• Fine-grained authorization: it tells you who the user is, which tenant they are in and which labels they carry — what they may do is your app’s call