Features · Sign-in

Your app never sees a password.

User accounts are the reason small tools stay on localhost. Astrodock does them once, for everything you deploy.

How it works

You send them away

Your app redirects to the platform's own address. Whatever happens there is not your code's problem.

The platform asks

Password, passkey, second factor — whichever you've turned on. It also checks they're allowed into this particular app.

You get a code, not a credential

They come back with a one-time code. Your server trades it for their identity and starts a session of your own design.

Why it matters

The riskiest code is the code you skip.

Hand-rolled auth is where small projects get hurt: a password logged by accident, a reset flow nobody tested, a session that never expires. None of that exists here, because none of it is in your app.

It also means the tool you wrote in an afternoon can have passkeys and two-factor — things you would never have built for it, because they belong to the platform.

One session, every app Sign in once, reach everything you're granted

Access per app The rota tool, but not payroll

Or none at all A landing page doesn't need a login

In your code

Two routes, and you are done.

The whole integration is a redirect out and a code exchange back. There is no user table, no password hashing, no reset flow, and no session library to choose.

server.js

// send them to the platform
app.get('/api/login', (req, res) => {
  res.redirect(auth.authorizeUrl({ redirectUri, state }));
});

// they come back with a code, not a password
app.get('/api/auth/callback', async (req, res) => {
  const user = await auth.exchange(req.query.code, { redirectUri });
  // { userId, email, name } — now mint your own session
});

Next Databases & storage Its own Postgres and bucket, or yours

Or install Astrodock and try it on a machine you control.