Email, password and Google
People sign up with an email and password or with Google. Common and breached passwords are refused, and a Google sign-in joins a verified account with the same email.
Praman by Notils is in public beta
Sign-in for your own apps.
Email, password and Google sign-in, with verification and reset emails that carry your app’s logo. Every user, sign-in and email is visible in your dashboard.
- Runs RentDera in production
- Separate test environment
- Signed webhooks
acme-shop · Users
ProductionATVerified
Asha Thapa
Google · Chrome on Android
RSVerified
Ram Sharma
Email · Safari on iPhone
SRUnverified
Sita Rai
Email · Firefox on Windows
password-reset to ram@example.com · sent
Features
The sign-in your app needs, without building it
Accounts, sessions, emails and organizations, run by Notils and shown to your team in one dashboard.
Emails with your app's logo
Verification codes, password resets, security alerts and invitations go out with your app's name and logo. Nothing to design or host.
Every user, in your dashboard
See each person's sign-in methods, whether their email is verified, when they were last active and their recent sign-ins. Sign them out of every device when you need to.
Sign-in activity and an email log
Sign-ups, sign-ins, failed attempts and password resets, with device and browser. The email log shows whether each code went out, never what it said.
Organizations built in
People can create organizations inside your app and invite others with a role. You see every organization and its members; your app runs them.
Invitations for the right person
An email invitation can only be accepted by an account holding the invited address. Opened by anyone else, it stays unused for the person it was meant for.
Production and Development
Add a Development environment to any project for testing, with its own users and settings. Production is never touched by it.
Signed webhooks
When someone accepts an invitation or a membership changes, your backend gets an event signed with your project's secret.
Tokens you can verify yourself
Short-lived ES256 access tokens your backend checks against a public key set, and refresh tokens that rotate on every use.
Environments
Test with real sign-ins, away from real users
Every project starts with Production. Add a Development environment when you need one: it has its own id, users and settings, so test accounts never mix with your customers.
Production
X-Notils-App: acme-shop
- Your real users, organizations and sign-in activity
- Emails sent exactly as your users see them
- Can't be deleted from the dashboard
Development
X-Notils-App: acme-shop-dev
- Separate test users, organizations and settings
- Every email subject starts with [Development]
- Copy its name and logo to Production on purpose
- Delete it, and all its test data, by typing its id
For developers
Name your project in a header. That's the setup.
Your app calls Praman with its project id. Sign-up and login return a token pair; your backend verifies access tokens with Praman's public keys.
- /v1/auth/signup
- Create an account
- /v1/auth/login
- Email and password
- /v1/auth/oauth/google
- Google ID token
- /v1/auth/token/refresh
- Rotate the pair
cURL
$ curl https://auth.notils.com/v1/auth/login \
-H "X-Notils-App: acme-shop" \
-H "Content-Type: application/json" \
-d '{ "email": "ram@example.com", "password": "…" }'
HTTP/1.1 200 OK
{ "access_token": "eyJhbGc…", "refresh_token": "prt_…",
"expires_in": 900, "user": { "email": "ram@example.com", … } }FAQ
Questions, answered
Add sign-in to your app today
Create a workspace, add a project, and send its id with your first sign-up.