Auth gateway for SaaS apps

Sign-in, sessions, and licenses. One gateway.

NubeAuth runs the OAuth handshake with PKCE, hands your app a session token, and tells it which plan each user is on. You set it up in the admin console and call it from your code.

Open the admin consoleRead the quick start

Free during beta. Sign in with Google.

One sign-in, start to finishapi.nubeauth.com
  1. GET/v1/auth/start?app_id=APP0x7k2&code_challenge=…PKCE S256. Redirects the browser to Google.302
  2. GETaccounts.google.com/o/oauth2/authThe user picks an account.302
  3. GET/v1/auth/callback/google?code=4/0Ad…Location: https://yourapp.com/auth?code=… (one use, 60 s)302
  4. POST/v1/auth/token{ "sessionToken": "…", "userId": "USR0q41m" }200
  5. GET/v1/license/APP0x7k2{ "plan": "pro", "status": "active" }200

The one-time code is worthless without the verifier your app kept.

Product

One account, four places to work.

A single sign-in carries across every NubeAuth surface. Each one has a single job.

manage.nubeauth.com

Admin console

For you and your team

Create projects and apps, connect OAuth and payment providers, define plans, and invite teammates.

Open the console →

me.nubeauth.com

User portal

For the people using your app

Your users update their profile, see where they are signed in, and end sessions they do not recognise.

Open the portal →

api.nubeauth.com

Gateway API

For your code

Start sign-in, read the current user, and check a license from your frontend or your server.

See the API →

docs.nubeauth.com

Docs

For integration

Quick starts for React, plain JavaScript, and browser extensions, plus the full API reference.

Read the docs →

What the gateway handles

The auth work you would otherwise maintain.

Everything below runs behind the gateway. Your app makes a few requests and reads the answers.

Sign-in
Google and GitHub OAuth with PKCE. Configure providers once per project or override them per app.
Sessions
Bearer tokens for your apps, HttpOnly cookies with CSRF checks for the dashboards. Requests are rate limited, and users can revoke any session from the portal.
Licensing
Plans with trials and monthly, yearly, or lifetime billing. Your app asks GET /v1/license/:appId and gets the plan back.
Payments
Stripe, LemonSqueezy, and Dodo. Provider credentials are stored encrypted, and every webhook is logged and deduplicated.
Team
Invite teammates to a project as owner, admin, or member. Each role sees only what it is allowed to change.

How it works

From empty project to signed-in user.

  1. Create a project

    Sign in to the admin console and create a project. Invite your team and connect a payment provider if you charge.

  2. Add your app

    Register the app, turn on Google or GitHub, list your redirect URLs, and define the plans users can hold.

  3. Call the gateway

    Start sign-in, swap the returned code for a session token, then check the license. The quick start covers React, plain JavaScript, and extensions.

auth.ts
import { NubeAuthClient } from '@nube-auth/client';

const gatewayUrl = 'https://api.nubeauth.com';
const appId = 'APP0x7k2';
const nube = new NubeAuthClient({ gatewayUrl, appId });

// 1. Send the user to sign in
const { url, codeVerifier } = await nube.app.buildOAuthUrl({
  returnTo: 'https://yourapp.com/auth',
});
sessionStorage.setItem('pkce', codeVerifier);
location.assign(url);

// 2. Back on /auth?code=…, swap the code for a token
const { sessionToken } = await nube.app.exchangeCode(code, {
  codeVerifier: sessionStorage.getItem('pkce'),
});

// 3. Ask which plan they are on
const user = new NubeAuthClient({ gatewayUrl, appId, sessionToken });
const { plan, status } = await user.license.getDetails();

Create your first project.

It takes a Google account and about five minutes.

Open the admin consoleRead the docs