Auth for your app
Use Foir as the authentication layer for your app — hosted login, customer accounts, sessions, and roles — without touching the CMS. You get a login screen your users can sign in to today, EdDSA access tokens your backend can verify, and customer data that is isolated per project at the database layer.
This track is for teams who want an auth provider (the way you’d reach for Clerk, Auth0, or Better Auth), not a content platform. Everything here works whether or not you ever define a single content model.
What you get
- Hosted login at
auth.foir.dev(or your ownlogin.your-domain.com) — Foir renders the UI, you get the tokens back. See Login with Foir. - Password, OTP, and OAuth/OIDC sign-in, plus customer accounts with per-customer profile and metadata.
- Short-lived EdDSA access tokens (15 minutes) and rotating refresh tokens (30 days), verifiable from your backend against a public JWKS — see Customer Authentication.
- Database-level isolation. Customer-owned rows are protected by row-level security keyed to the signed-in customer, not by application checks you have to remember to write. See Authorization.
- Lifecycle webhooks —
customer.created/updated/deletedand session events delivered to a URL you register. See Webhooks. - Usage-based billing you can see — monthly active users, admin seats, and auth email sends, metered and surfaced in the dashboard. See How auth is billed.
Four ways to integrate
Pick the shape that fits your app. All four return the same customer tokens.
| Approach | You build | Best for |
|---|---|---|
| Hosted (Login with Foir) | A redirect and a callback route | Most apps — no login UI to build or maintain |
| Token API | Your own login form calling customerLogin / customerRegister / OTP | Apps that want a fully custom sign-in UI |
| First-party sessions (BFF) | A thin backend that swaps tokens for an HttpOnly cookie | Apps with a server that want cookie sessions, not bearer tokens |
| Foir-hosted sessions | Nothing — Foir sets the cookie on your domain | Backend-less SPAs that still want no tokens in JavaScript |
The hosted flow is the recommended default: you register your app once, add a redirect and a callback, and Foir hosts everything in between. Start with the Quickstart.
The last two give the strongest posture — no access or refresh token is ever reachable from JavaScript. Use the BFF if you have a server; use Foir-hosted sessions if you don’t (it needs a custom login domain).
Where to go next
- Quickstart — add login to your app in about ten minutes.
- SPA (no backend) — cookie sessions for a Vite/CRA app with no server.
- React & Next.js — drop-in components, hooks, and the Next.js server adapter.
- How auth is billed — what an MAU, a seat, and an email send cost against your plan.
- Migrating to Foir — bring customers over from Clerk or Better Auth.
- Login with Foir — the full hosted-flow reference.
- First-Party Sessions (BFF) — the cookie-session pattern.