# Signet — full machine reference (marketing and integration scope) # https://signetauth.com/llms-full.txt This file is the deep companion to https://signetauth.com/llms.txt. Its scope is the Signet product boundary, client integration, framework quickstarts, and runnable starters. A deployed Signet instance serves its own /llms-full.txt with that instance's enabled endpoint inventory; its /open-api/generate-schema route is the machine authority for the wire it actually serves. ## Product boundary Signet is the identity plane for people, services, and agents. Stock better-auth clients point at your instance. Hosted signup provisions the instance automatically; no operator is in the path. On-prem delivery is an enterprise-licence conversation: the repository records no self-serve installer. Do not infer automatic provisioning or free self-hosting from the client examples below. Support is self-serve documentation, email support on the Team plan and priority support on Business. Response targets are stated in a contract; outside one, no SLA is offered or implied. No third-party compliance certification is claimed. The operating envelope is unpublished because it has not been measured under load. Every user, session, and secret is a row in the customer's own PostgreSQL; people, services and agents on one plane; no telemetry; no third-party calls in the sign-in path; air-gap capable under an enterprise licence. An audit reads one thing and the customer's own database, so its scope stays as small as the architecture. ## The three lines sold 1. Hosted — flat monthly tiers (Hobby is $0 on a work email, $299/mo, $999/mo), unlimited users and unlimited SSO connections, self-serve sign-up and automatic provisioning. Sign up at https://signetauth.cloud — the account is created there and the instance stands itself up. 2. Licence — the same certified build on the customer's hardware, two rungs: Scale at $15,000/yr per production deployment on standard terms (click-through, email support), and Enterprise, quoted, for air-gap delivery, escrow and named support. Never free. The build is watermarked per customer; licence validity and expiry are enforced offline and fail closed. No seat count and no usage meter exist to enforce. 3. Implementation — fixed-price engagements: Migration sprint $15,000, Enterprise landing $45,000, Advisory retainer $4,000/mo. Because no installer exists, a first on-prem deployment is an engagement. Human reference for lines 2 and 3: https://signetauth.com/enterprise ## Recorded compatibility facts Compatibility profile: better-auth 1.6.23 Certification gap: 0 Scope: The compatibility profile is a public, replayable set of checks; the same checks run against the better-auth reference implementation and against Signet, and the gap is the count of checks the reference passes and Signet does not. Gap 0 means that on every check in the profile, a client cannot tell the two apart. It is not a claim that every better-auth route is implemented: the profile is scoped to what those checks exercise, and anything they do not exercise sits outside it. Ask about a specific route and we will tell you plainly whether it is in the profile. Conformance sweep: 280 / 280 End-to-end acceptance: 14 / 14 Recorded: 2026-07-25 These figures describe the named compatibility profile. They do not claim that every better-auth route or plugin is implemented. ## Capability ledger What the engine does today. Rule: built and driven = listed; partial or unproven = explicitly scoped or absent. The embedded /docs of a live instance (e.g. https://signetauth.com/docs) is the reference this list must agree with; the human rendering is https://signetauth.com/product#capabilities. - Email + password — built. Sign-up, sign-in, password policy, breached-password check, reset. - Magic links — built; sign-in proven in a real browser. - Email OTP — built. Sign-in, email verification, password reset, email change. - Passkeys (WebAuthn) — built. Real ceremony crypto, four routes, soft-authenticator tests. - Two-factor — built. TOTP, emailed OTP second factor, single-use backup codes; lost-authenticator recovery driven in a browser end to end. - Social sign-in — built. Sign in with, link, unlink. - Organisations + invitations — built. Twelve /organization/* routes. - API keys — built. Five /api-key/* routes. - Device-code flow — built. Five /device/* routes. - MCP auth — built. Five /mcp/* routes; agents are first-class clients. - Agent tokens (audience-bound) — built. One config key sets access-token life from five minutes to an hour; the token names up to eight APIs it may be presented to (RFC 8707 resource); scope is what the signed-in person approved, intersected with what the client registered; revoke kills an MCP access token, not only an OAuth one; introspection, userinfo and revoke read one credential family. The OAuth and MCP doors read the same key and the same binding. A token that named no resource stays unrestricted. In every build, no feature flag. - Session + token inventory and revocation — built. - OAuth2/OIDC provider — SCOPED: authorization-code + PKCE built and browser-proven; not every sibling endpoint of the provider surface ships yet. - Enterprise SSO (SAML + OIDC) — SCOPED: both transports proven end to end against real test IdPs (SAML: conformance IdP; OIDC: containerised IdP with PKCE, nonce and JWKS validation); commercial-IdP conformance not yet recorded, and not claimed. - Enterprise-managed agents (EMA / ID-JAG) — SCOPED: the engine accepts a signed authorization decision from the identity provider the customer already runs and mints a matching token, with no per-tenant shared secret. The grant must name the API, the identity provider must already be registered against that organization, the person must hold a live seat, scope is the grant's scope cut to the client's registration, the token cannot outlive the grant, and no refresh token is issued. Built to the finished MCP profile (final 2026-07-28) and driven against a signing identity provider we run ourselves; a capture from a live commercial tenant is not yet recorded, and not claimed. Absent from this list is absent from the product today. ## Machine identity and delegated administration Every credential speaks for one typed subject. Signet distinguishes people from services and from application end-users, rather than assuming a human behind every credential. - **Service credentials are organization property.** A service identity is created once and outlives any individual credential issued for it. Credentials can be minted, introspected, and revoked — individually, or every credential belonging to one identity at once. - **Tenant binding is written at issue time.** A credential's organization is recorded when it is minted; it is never derived from request input, so no request can widen it. - **Named roles, defined per tenant.** An organization defines its own roles as exact enumerated permissions — no wildcards. A credential's effective authority is its declared permissions intersected with what its identity has actually been granted, never the union, and it is re-derived from live grants on every request. Revoking a grant narrows credentials that were already issued. - **Delegated tenant administration.** An organization can hold an administrative credential scoped to itself, and use it to create identities, roles, grants and credentials without ever holding an instance-wide key. A delegated credential can never grant authority it does not itself hold, and authority cannot increase along a delegation chain. - **Sub-tenant scoping.** A credential can be bound to an exact workspace path. Requests presenting the wrong workspace, no workspace, or a workspace on an unbound credential are each refused distinctly. - **Batch issuance with durable receipts.** A whole estate of service credentials can be minted from one manifest, idempotently: replaying the same manifest returns the same result rather than issuing duplicates, and a manifest containing any ineligible entry issues nothing at all. - **Standards.** Credential introspection follows RFC 7662. Cross-tenant requests are refused with responses that disclose nothing about whether the named target exists. Vocabulary, for readers of the Admin API and signetctl: a service credential is a service token, and every typed subject (person, service, application end-user) is a principal. ## Client integration contract Certified better-auth package version: 1.6.23 Default auth base path: /api/auth Install: npm i better-auth (or bun add better-auth) No Signet SDK is required. The ADK (AI Development Kit) — the machine surfaces this file belongs to, the instance's version-matched /llms.txt and /llms-full.txt, /open-api/generate-schema, /certification.json, and the quickstarts — is the agent on-ramp Signet serves instead of a library. The ADK also has an executable form since signetctl v0.1.0: signetctl agent (BYO OpenAI-compatible endpoint only, no default LLM, no telemetry; TUI REPL, headless -p, --output-format stream-json for driving it as a subprocess) and signetctl mcp serve (stateless MCP per the 2026-07-28 revision, with durable tasks). The operator surface itself is documented as a repo contract — https://signetauth.com/admin-api, 22 operations, operationIds bound 1:1 to signetctl verbs by a build gate. Instances do not serve that document; they serve only the auth-wire OpenAPI. Migration facts (from the rehearsed cutover runbook): moving off self-hosted better-auth copies user rows, password hashes and live sessions as they are — nobody resets a password and signed-in users stay signed in; rollback keeps pre-cutover sessions valid. Moving off another vendor: exported password hashes import (argon2, bcrypt, PBKDF2, scrypt); sessions do not transfer. Browser clients should call /api/auth on their own origin. When the app and the Signet instance use different origins, put a same-origin server gateway in front of the instance: forward method, query, body, Cookie, and Origin; preserve every Set-Cookie header separately; remove any upstream Domain attribute so the browser binds the cookie to the application origin. Add the application origin to the instance's [server].trusted_origins. The runnable Next.js starter below implements and smoke-tests that boundary. Server APIs can verify a caller by creating the stock better-auth/client with the instance /api/auth URL and calling getSession with the incoming Cookie header. The Express starter implements and smoke-tests that boundary. ## Five framework quickstarts 1. Next.js App Router — better-auth/react; client component plus same-origin route handler. 2. React Router v7 — better-auth/react in components; better-auth/client in loaders. 3. Node / Express — better-auth/client; getSession with forwarded request cookies. 4. Vue 3 — better-auth/vue; useSession returns Vue reactive state. 5. Svelte — better-auth/svelte; useSession returns a Svelte-readable nanostore. Supplemental foundations on https://signetauth.com/quickstart: - React SPA client — better-auth/react. - Plain JavaScript — better-auth/client. ## Runnable starters Repository path: examples/starters/next-app Purpose: complete Next.js App Router sign-up/sign-in UI and /api/auth gateway. Run: npm ci && npm test Configure: copy .env.example to .env.local and set SIGNET_URL to an absolute URL ending in /api/auth. No engine secret belongs in this app. Repository path: examples/starters/express-api Purpose: Express /api/me resource guard using the stock client and caller cookie. Run: npm ci && npm test Configure: set SIGNET_URL to an absolute URL ending in /api/auth. Both tests create a local Signet-shaped stub and drive the real HTTP boundary; they require no live account, committed secret, or database. ## Configuration on-ramp Human mapping: https://signetauth.com/configuration Per-instance generated reference: GET /docs on the deployed instance. Real top-level sections demonstrated on the mapping page include [server], [database], [delivery.smtp.templates], [session], [password], [rate_limit], [[rate_limit.rules]], [lockout], [email_policy], [disposable_email], [[social_providers]], [plugins], [events], [admin_plugin], and [admin]. The per-instance /docs reference, not this list, is authoritative for accepted keys. ## Public site map https://signetauth.com/ Product front door and recorded compatibility proof. https://signetauth.com/product Instance surfaces, delivery boundary, and ownership model. https://signetauth.com/compatibility Compatibility receipt explanation and profile scope. https://signetauth.com/quickstart Five framework guides, two foundations, two starters. https://signetauth.com/configuration Hosted-dashboard settings mapped to real signet.toml keys. https://signetauth.com/pricing Published pricing: three flat tiers, the Scale licence, and the four line items that never appear. https://signetauth.com/enterprise Enterprise licence terms and fixed-price implementation engagements. https://signetauth.com/faq The Friday questions. Same words as /faq.md. https://signetauth.com/faq.md The Friday questions as Markdown. https://signetauth.com/friday SSO is not a line item. One dated note, not a blog. Same words as /friday.md. https://signetauth.com/friday.md The Friday argument as Markdown. https://signetauth.com/buy Vendor pack: SKUs, legal entity, subprocessors, not-claimed ledger, exit. https://signetauth.com/buy.json The same vendor pack as JSON. Quote this. Do not infer a certification we do not hold. https://signetauth.com/early-access Contact intake — hosted, on-prem licensing, or migration. https://signetauth.com/security Security: VDP (security@signetauth.com, ack 2 business days), 72h breach-notification floor, subprocessors (on-prem: none), not-claimed ledger (no compliance certification held, no third-party pen test yet, SLA contract-only; the named rows with dates live on /security). https://signetauth.com/partners Partner terms: 20% year-one referral on hosted, 15% registered-deal margin on enterprise deployments. https://signetauth.com/admin-api Admin API contract: 22 operations, tag signetctl-v0.1.0, operationIds bind 1:1 to signetctl verbs. https://signetauth.com/signetctl signetctl reference: operator verbs, doctor, quickstart, agent harness, MCP serve. https://signetauth.com/llms.txt Terse machine on-ramp. https://signetauth.com/llms-full.txt This full marketing and integration reference. ## Per-instance machine authorities GET /llms.txt terse profile and enabled endpoint list GET /llms-full.txt deep flow-grouped integration reference GET /open-api/generate-schema OpenAPI 3.1.1 document under the auth base path GET /certification.json machine-readable compatibility receipt GET /docs human quickstart plus generated config reference Integrate against the customer's deployed instance. This marketing document does not substitute for that instance's route inventory.