Sign-in and users
Sign-in for your app, with the users in your own database.
Lathe runs Auth for you on the dedicated machine that runs your app and its Postgres: sign-in by email link or code, OAuth with GitHub, Google and the other providers, multi-factor, sessions and refresh tokens, with every user in the auth schema of your own database, readable by your role. It is built on the open-source Supabase Auth server, so supabase-js and the Supabase auth clients work unchanged. It needs Postgres and the Apps engine on the same machine: the users live in the one, and sign-in is served behind the other. In the plan price, with no price per user.
What you get with Auth on Lathe.
- Every way in
- Magic links and one-time codes by email, passwords with a breach check, OAuth with twenty providers, TOTP, passkeys and security keys.
- Your users, your table
- Users live in the auth schema of the instance's Postgres. Query them, join them, back them up with everything else; nothing to export from a vendor.
- Standard tokens
- ES256 JWTs, verified in your own code against the published keys without asking the server.
- A name of its own
- Sign-in answers on its own hostname beside your app's, or on a domain of yours with an A record, so the two never share an address.
- Settings, not a dashboard
- Site URL, redirect list, sign-ups, providers, SMTP, mail templates, session lengths, rate limits and MFA: every setting from the portal, the API or MCP.
- Your users, in front of you
- The portal lists and searches them, adds one with or without a password, mails an invitation, a sign-in link or a password reset, bans an account or removes it. The same from the API and over MCP.
- An app on the machine finds it
- An app that links auth gets its URL and keys in its environment. Nothing to configure.
- How it runs
- The open-source Supabase Auth server, pinned by version, run beside your app with your Postgres as its store. Updates in the fixed weekly window (Sundays 03:00 UTC), announced in advance.
- On the same machine
- Postgres, Redis, CouchDB, NATS, Apps and Auth can run together on one dedicated instance; switch any of them on or off later, each with its own memory budget.
Address
https://db-7f3a-auth.lathe.computer/auth/v1
Sign-in answers over https on a name of its own; a browser presents the anon key, your server the service key.
Good for
- Sign-in for the app hosted on the same machine
- A browser or mobile app using supabase-js against your own database
- Moving off a platform without rewriting sign-in
- A product where a price per user would decide the business model
Questions about Auth
Is it priced per user?
No. Auth is not billed by user: it is in every plan, and the plan price is the whole invoice. What a bigger user base needs is more of the machine - CPU, memory and storage - sized by the plan you pick, never counted per user.
Does supabase-js work?
Yes, unchanged: createClient with the URL and the anon key, then signInWithOtp, signInWithOAuth and getSession as documented. Auth is built on the open-source server behind Supabase Auth, so their clients speak to it as they would to Supabase.
Where do the users live?
In the auth schema of your instance's Postgres, under a role of their own, readable by yours. They are in every backup with the rest of the data.
What does it need?
Postgres and the apps engine on the same machine: the users live in the one and sign-in is served behind the other. Switching it on is one change, with nothing to fill in.
Also on Lathe: Postgres 17, Redis 8, CouchDB 3, NATS 2, Apps. See pricing, or the home page for the whole offer.
Auth beside your databases, from $15 a month.
Live about 90 seconds after checkout. Cancel any time; Mini starts with a 3-day free trial.
Start free - 3 days, no card needed