Skip to content
OIDOT

Authentication

Sign-up and login, done correctly by default.

Email and password authentication with Argon2id password hashing, secure session cookies, and enumeration-safe endpoints — the fundamentals most products get wrong, solved once.

The fundamentals, actually correct

Most authentication bugs aren't exotic — they're a password hashed with the wrong algorithm, an error message that reveals whether an email is registered, or a session cookie that isn't marked secure. Oidot's authentication is built to get these right from the first request, not the first incident.

Password reset and email verification follow the same discipline: every link is single-use and time-limited, and every endpoint responds the same way whether or not the account exists.

Features

Argon2id password hashing

A modern, memory-hard hashing algorithm — not a legacy hash inherited from an older system.

Enumeration-safe endpoints

Login, signup, and password reset all respond identically whether or not an account exists.

Secure session cookies

HttpOnly, secure, same-site session handling — no tokens sitting in localStorage.

Email verification & password reset

Single-use, time-limited links for verification and reset, not long-lived tokens.

Authentication request flowA login request is verified against the stored Argon2id hash before a session is issued.credentialsmatchClientAuth endpointArgon2id verifySession issued
data-flow diagram: A login request is verified against the stored Argon2id hash before a session is issued.

Add authentication to your product

Start free and see the flow yourself.