Sign-in you own,
for every product you ship.
ARZS Auth is the authentication server behind your apps: email codes, Google, Apple, and WhatsApp reverse-OTP that costs nothing and can’t be pumped — with per-tenant keys and zero vendor lock-in.
Simple outside. Strict inside.
Every guarantee below is pinned by a test or a review rule — not a setting someone can forget.
WhatsApp reverse OTP
The user messages us the code. Nothing outbound to pay for, nothing for an attacker to inflate.
Per-tenant keys
Each tenant signs with its own ES256 key. Another tenant’s token fails at the signature, not a claim check.
Rotation without sign-outs
The old key stays published until every token it signed has expired. Nobody gets kicked out.
Default-deny origins
An exact allowlist per app. No wildcards, no environment-wide list to get wrong.
No plaintext secrets, no PII in logs
Codes and tokens are hashed, keys are sealed, and the audit trail holds hashes only.
Failures stay local
A misconfigured app loses that one method. The server and every other tenant keep running.
The user messages us. The message is the proof.
Free, because inbound is free. Phone-bound, because the sender must match the number claimed.
- 1Scan or tapDesktop shows a QR; mobile opens WhatsApp directly.
- 2Send the codeOne prefilled message. Nothing is sent from our side.
- 3Confirm the contextCross-device or strict apps: “Is this you?” inside WhatsApp.
Two consoles. One for each side of the line.
Tenant owners run their apps. Operators run the platform. Nobody browses data they don’t need.
Tenant consolefor owners
- Methods, providers, origins and credentials per app
- Exact-match user lookup, with audited PII reveal
- Key rotation, live-preview branding, audit log
Operator consolefor the platform
- Create and suspend tenants, key age across the fleet
- Health, boot drift results, WhatsApp numbers
- Read-only operator list — a stolen session can’t grow it
Every method is opt-in, per app.
One tag to sign in. One call to verify.
Your backend verifies locally against the tenant’s JWKS — no network call per request.
<!-- your page --> <script type="module" src="https://auth.arzs.me/t/zekra/ui/v1/signin.js"></script> <arz-signin client-id="app_7Hq2KxW9pL"></arz-signin>
// your Go backend v := authclient.New(authclient.Config{ IssuerURL: "https://auth.arzs.me/t/zekra", Audience: "app_7Hq2KxW9pL", }) claims, err := v.Verify(ctx, bearer) // claims.Subject → key your own roles on it
Zero to first tenant in four commands.
One binary, Postgres, and a master key. Redis is optional until you run a second instance.
Own your sign-in.
Authentication only — “who is this person”. Authorization stays in your app, keyed on sub.