I built Signet for the day a big customer asks for SSO. You add their identity provider in settings and your bill stays the same. Every user, session and API key is a row in a database that’s yours.
Already on better-auth? Keep your client and change one URL.
baseURL: "https://old-vendor.example.com", baseURL: "https://auth.acme.com",
Herman Geldenhuys, GeldenTech Inc., Montreal. Signet’s own console signs in through Signet.
Type your app’s name. The passport is drawn from it, so no two come out the same.
A person signs in with a passkey, an email code or, on Team, their company’s SSO. Tear the session and its row is deleted outright. The audit log keeps who did it and when.
Your billing worker and your webhook relay carry API keys. They last until you give them an end date or revoke them, and revoking is one call.
An agent acts for one person, inside a scope you set, through MCP. Its token expires on its own even if nobody remembers to cancel it. A renewal is a new token, so you can cancel that one too.
In a real instance, all three are rows in your own database.
All of this works today. The product page marks the few features my tests don’t fully cover yet.
Every Signet instance serves its own sign-in page at /login, with sign-up and password reset beside it. Send people there, or keep your own screens and call the same API with the better-auth client.
/login page.Identity providers replace their SAML signing certificates every few years. In better-auth’s SSO plugin there is no stock way to do that once people have signed in. You delete the connection and register it again. That unlinks everyone who signed in through it. With domain checks on, sign-in stays blocked until your customer publishes a new DNS record (issue 11471, open on 10 Oct 2026).
In Signet you send the new certificate in one call. The callback URL stays the same. The connection and its members stay, and nothing changes in DNS. The change goes into the audit log. Signet checks that the new certificate is in date before it accepts it.
Signet swaps the certificate. It never trusts the old one and the new one at the same time. So sign-ins through that connection fail between your customer’s switch and your call. Make the call right after they switch.
Keep the better-auth client you already ship and change one URL. User rows, password hashes and live sessions copy across, so nobody resets a password. If you roll back, every session issued before the cutover is still valid.
import { createAuthClient } from "better-auth/client" export const auth = createAuthClient({ baseURL: "https://old-vendor.example.com", baseURL: "https://auth.acme.com",})
It’s the stock client: bun add better-auth. Tested against better-auth 1.6.23 on 22 July 2026.
Every enterprise customer brings its own SSO connection. Your fifteenth costs what your first did, which is nothing extra.
WorkOS lists SSO at $125 per connection a month for the first 15 connections (workos.com/pricing, checked 4 Oct 2026).
Prices effective 2026-08-07. Team runs on a PostgreSQL database dedicated to you. Hobby is free and keeps your data in encrypted SQLite.
Those lines stay at $0 because Signet doesn’t count active users at all.
Attach an NDA, a licence or a pledge on personal data to an app that signs people in through Signet as its OAuth provider. Signet shows people the full text and lets them in only after they accept.
Also kept: the app, the IP address and the browser.
It is a record, not legal advice: I can’t tell you whether a click is enough for your agreement.
Your security reviewer would find these anyway, so here they are up front.
If one of them rules Signet out, you should know now and not six weeks into a review. The vendor pack has the rest on one page: legal entity, subprocessors and how to leave.
Every instance, yours included, publishes its own test results at /certification. The security page tracks what’s still missing.
Do you have anything to declare?
We declare:
Hosted, you ask and I hand you the file. On your own servers you run it yourself. Hobby uses encrypted SQLite, which takes one more step: the export guide.
pg_dump --no-owner "$SIGNET_DATABASE_URL" > signet.sql
Sign up and your instance is running in a few minutes, no call needed. Want Signet on your own servers? That’s an enterprise licence, and you’ll talk to me directly.