Authentication
Sign-up and login, done correctly by default.
Email and password authentication with Argon2id password hashing, secure session cookies, and enumeration-safe endpoints — the fundamentals most products get wrong, solved once.
The fundamentals, actually correct
Most authentication bugs aren't exotic — they're a password hashed with the wrong algorithm, an error message that reveals whether an email is registered, or a session cookie that isn't marked secure. Oidot's authentication is built to get these right from the first request, not the first incident.
Password reset and email verification follow the same discipline: every link is single-use and time-limited, and every endpoint responds the same way whether or not the account exists.
Features
Argon2id password hashing
A modern, memory-hard hashing algorithm — not a legacy hash inherited from an older system.
Enumeration-safe endpoints
Login, signup, and password reset all respond identically whether or not an account exists.
Secure session cookies
HttpOnly, secure, same-site session handling — no tokens sitting in localStorage.
Email verification & password reset
Single-use, time-limited links for verification and reset, not long-lived tokens.
Add authentication to your product
Start free and see the flow yourself.