Unlimited SSO. Same bill. Same wire.

Absent from this table is absent from the product today. If a capability you need is missing, ask us. The answer might be a date.

Where the decision comes from your customer’s own identity provider rather than from your app, that is the enterprise-managed road →

Your side of the integration is a base URL. The client stays the stock better-auth package you already use: it points at your Signet instance instead of your current vendor, and the calls you have written keep working. That holds whether the instance is one we host or one running inside your walls under an enterprise licence: the wire is the contract, and it does not change when the engine changes address.

import { createAuthClient } from "better-auth/client";

// Your existing better-auth client: point baseURL
// at your Signet instance. The wire is the contract.
export const authClient = createAuthClient({
  baseURL: "https://auth.example.com/api/auth",
});

// The same calls you already write. They just work.
await authClient.signIn.email({ email, password });

• The instance checks itself before it serves. Its configuration is validated with no network at all, then validated again against the live URL; both checks are in the engine, so there is no external tooling to install or trust.
• Nothing secret sits in the config file. The signing secret and the database URL are supplied to the process separately, and the schema applies itself on first boot.
• You point your better-auth client at /api/auth. That is the whole change on your side: one URL. It reads the same hosted or on-prem.

Working in a framework? The quickstart has five literal framework paths: Next.js, React Router v7, Node/Express, Vue 3, and Svelte, plus React and vanilla-client foundations.

Every user, session, and secret lives in your own PostgreSQL, behind an /admin operator surface you control. Signet is the same build whether we run it or you do: start on a managed instance and, the day you need to, take it onto your own hardware under an enterprise licence, without changing a line of client code. The wire does not change.

Leaving does not require us. pg_dump, pg_restore, boot. An enterprise licence puts the engine in your hands, so if we disappeared tomorrow your auth keeps running, and the wire never changes.

Ownership runs to the configuration too: every setting lives in signet.toml in your own repository, not a hosted console. Configuration is the dashboard →

The differential conformance sweep is 280 / 280: every check in the public compatibility profile runs against the reference implementation and against Signet, and the results are compared. The profile counts only checks the reference implementation itself passes; Signet is not graded on checks the reference fails. The compatibility gap (a check the reference passes and Signet does not) is 0.

Separately, end-to-end acceptance is 14 / 14: better-auth’s unmodified client drives real sign-up, session, organization, and two-factor flows. Both runs were recorded 2026-07-25. The receipt is a recorded pointer to those runs, not an implied cryptographic attestation, and every instance serves its own copy so you can verify it yourself.

Signing up provisions the instance automatically. The process ends in a receipt: a live /health check plus an end-to-end sign-up, sign-in, and get-session smoke against the live URL. Proven from zero on 2026-07-21: health 200, smoke 3/3.