Identity and access for your apps

Sign-in, users and access for every app you build.

One hosted sign-in, invite-only access, roles and permissions, an admin console for your customers and a full audit log. Add it to an app in an afternoon, and stop rebuilding login for each new one.

Talk to us See how it works

Emailed codes and passkeys, no passwords to leak
Runs on AWS, in our account or yours

src/routes/+layout.server.ts

export const load = async ({ locals }) => {
  // Signed in, invited, not suspended: checked
  // by the platform on every request.
  const user = await requireUser(locals, {
    permission: 'invoices.edit',
  });
  return { user };
};

The SvelteKit SDK. The Go SDK is the same check as middleware.

Every new app rebuilds login, and gets it a little wrong

Whether a team writes it by hand or an AI tool generates it, each app ends up with its own sign-up page, password table, reset emails, admin screen and role checks. Each copy has its own gaps.

Anyone can sign up to an app that was meant for invited people only.
Passwords sit in a table nobody reviews, and reset emails become the weak point.
Removing someone means finding them in every app, and their sessions stay open.
Nobody can say who signed in, who was refused, or who changed a role last month.
Your customers' admins have no screen to manage their own people, so they ask you.

Everything an app needs about who may use it

Built once, tested against production, and shared by every app you connect.

Hosted sign-in

People sign in on one secure page with their email and a one-time code, or a passkey. Your app never handles a password.

Invite-only by default

Someone not invited is refused before any token is issued, and the refusal is recorded with the address they typed.

Roles and permissions

Each app lists the permissions its code checks, like invoices.edit, and groups them into roles. The SDKs answer can().

A console for your customers

Their admins invite, import and remove their own people, change roles and read their app's audit, and see nothing of anyone else's.

Reports

Sign-ins and people active per day and month, new and removed members, refused attempts. Per app and across all of them, with CSV.

Audit of everything

Every sign-in, refusal and change, with who, when and from where. Kept 400 days and exportable.

Bulk imports

Bring the users of an existing app from a CSV of any size, with live progress and a report of every row. Running it twice is safe.

Off everywhere, at once

Sign a person out of every app, disable them, or block an address or a whole domain. It takes effect within a minute.

Any stack

SDKs for SvelteKit and Go; for anything else, a step-by-step guide and an OpenAPI reference, written for people and AI coding agents alike.

Why not build it into each app?

Sign-in looks done the day the login page works. What follows is what makes it hold.

	Built into each app by hand or by an AI tool	Ultra Platform
Passwords	A table per app to protect, plus reset emails	None: emailed codes and passkeys
Invite-only	A check someone has to remember on each route	Enforced before any token exists
Removing a person	App by app; open sessions keep working	Once, everywhere, within a minute
Roles	Hard-coded, different in each app	Permissions you name, changed without a deploy
Audit and reports	Usually missing	Every sign-in and change, 400 days
Admin screens	Built again, or the customer emails you	A console your customers' admins use
Security work	Repeated, and reviewed per app if at all	Done once: reviewed, tested, kept up to date
Time to add to an app	Days to weeks	An afternoon

Running in three steps

1
Register your app
In the console: a name, and a sign-in client for each environment. You get the settings to copy.
2
Add the SDK
Two files and a .env in SvelteKit, one middleware in Go, or the guide for any other stack. The console gives a ready prompt for AI coding agents too.
3
Invite your people
One by one or from a CSV. They get an email naming your app and sign in with a code. You decide their role.

Security is the product

Platform administrators confirm every sign-in with a passkey, so a stolen mailbox alone reaches nothing.
The API your apps call runs apart from the platform's administration, with fewer rights and its own limits.
Tokens of the console never reach a browser; sessions live on the server.
Data is encrypted at rest in AWS, with point-in-time recovery, and every change is audited.
An internal security review is done; an independent review comes before general availability.

Talk to us

Tell us about your apps and who uses them. We answer within a working day, and can show you the console on a call.

Want it in your own AWS account and domain? Ask about a dedicated deployment.