Auth & Securityby SoftwareCrafting

Service Overview

We build authentication and authorisation that holds up to scrutiny, and we handle the parts teams reliably underestimate: session management, account recovery, and the enterprise requirements that arrive with your first large customer. Authentication is the easy half. The hard half is authorisation, deciding who can do what to which record, enforced consistently everywhere rather than scattered across route handlers where one missing check becomes a data breach. We design the permission model explicitly, enforce it at the data layer where possible, and test it as seriously as we test business logic. We work across session and token based approaches, OAuth 2.0 and OpenID Connect, SAML and SCIM for enterprise identity, multi factor authentication, and passkeys. Account recovery gets particular attention because it is where most implementations are weakest: the recovery path is often the real authentication mechanism, and if it is weaker than the primary one, the primary one does not matter.

Technologies we use

Key Features

• Social OAuth logins (Google, GitHub, Apple)
• Magic-link & OTP authentication
• Multi-factor authentication (MFA)
• Role-based access control (RBAC)
• JWT token management & refresh flows
• Enterprise SSO with Keycloak / SAML
• Session management and revocation
• Secure password reset flows
• Explicit permission model enforced consistently across the application
• Authorisation checks pushed to the data layer where possible
• Passkey and WebAuthn support alongside existing methods
• SAML single sign on and SCIM provisioning for enterprise customers
• Account recovery designed to be no weaker than primary authentication
• Session management with revocation, device listing, and step up authentication
• Audit logging of security relevant events
• Penetration test remediation and security review support