Do I have to use the hosted widget?

No. You can build your own signup and login screens against the server-to-server REST API and simply verify the returned session tokens from your backend. The widget is the fastest path, not the only one.

Does it support two-factor authentication?

Yes. End-users can enrol an authenticator app (TOTP), confirm it with a 6-digit code, and receive ten one-time recovery codes. You can also force-disable a user's 2FA from the dashboard if they get locked out.

Can I control password strength?

Yes. Password rules are off by default; you can require a minimum length, a number of digits, an uppercase letter, or a special character, and visitors see a live checklist as they type.

How do I stop the widget loading on sites that aren't mine?

Each public key has a domain allowlist. The widget only loads on the origins you list, and requests from other origins are rejected, so a leaked key can't be reused.

Can I keep my systems in sync when users sign up or change?

Yes. Seven webhook events fire on signup, verification, login, password-reset request, password change, suspension, and deletion, so you can push changes into your CRM or database in real time.

All apps

EngagementLive now

Customer AuthAdd sign-in without building auth

Add signup, login, email verification, and MFA to your own app with one snippet. Your users get real accounts; you get a dashboard to manage them.

Start freeView pricing

Signup, login, and email verification
Multi-factor authentication
Drop into your own website
Managed sessions and security

Drop-in widgets

Webhook events

Snippet to embed

Everything it does

Explore every feature

Tap a category to see what is inside. Nothing hidden, nothing bloated.

Complete end-user authentication

The full account lifecycle for your end-users, handled for you from first signup through password recovery.

SignupVisitors register with email, password, and an optional display name, with a password-confirmation field on the widget.
Email verificationNew accounts receive a branded verification email with a single-use token (24-hour expiry) and are marked verified on confirmation.
LoginEmail and password sign-in that returns a managed session token, or steps up to a two-factor challenge when 2FA is on.
Self-serve password resetUsers request a reset by email and complete it with a single-use token (1-hour expiry); a branded reset email is sent automatically.
Profile managementSigned-in users can edit their name and upload a profile photo (PNG, JPEG, WebP, or GIF).
Configurable password rulesTurn on a minimum length, required digits, an uppercase letter, or a special character, with a live checklist as the visitor types.

How it works

Live in a few steps

Install and create a key

Install Customer Auth, then create a public key and set its allowed domains so the widget loads only on your origins.

Embed the widget

Paste the one-line script snippet with your service id and public key onto any page; the Sign in / Sign up widget renders and auto-resizes.

Users sign up and verify

Visitors register, receive a branded verification email, confirm, and log in; those with 2FA on complete a step-up challenge.

Read the session in your app

On login the widget hands your page the session token; your backend verifies it, or you drop in the profile, 2FA, and sign-out widgets.

Manage from the dashboard

Watch users arrive in the End-users list, and view, suspend, force-logout, or remove any of them, with webhooks keeping your systems in sync.

Where it shines

Made for real work

Add accounts to a site that has none

Paste one snippet onto a static or hand-built site and instantly get signup, email verification, login, and password reset, with no auth backend to write.

Gate a members-only area

Verify session tokens from your own backend to protect paid content, downloads, or a portal, and suspend or remove users the moment access should end.

Ship two-factor authentication

Offer authenticator-app 2FA with recovery codes to your end-users by dropping in the two-factor widget, instead of building TOTP yourself.

Keep your own login UI

Build fully custom screens against the REST API for signup, login, MFA, and sessions, and subscribe to webhooks to sync users into your CRM.

For developers

Embed it, or drive it from code

Embed snippet

<script src="https://app.softsolz.uk/softsolz.js"
  data-public-key="pk_live_..."
  data-service-id="customer-auth"
  data-view="auth"></script>

Embed surfaces

Public widgetOne-line JS snippet

API scopes

service.customer-auth.users.readservice.customer-auth.users.manageservice.customer-auth.sessions.verifyservice.customer-auth.sessions.write

Webhook events

customer-auth.user.createdcustomer-auth.user.verifiedcustomer-auth.user.logged_incustomer-auth.user.password_changedcustomer-auth.user.suspendedcustomer-auth.user.deleted

Product guide Developer reference

Questions

Frequently asked

No. Customer Auth end-users belong to your own app's audience and are kept completely separate from the members of your SoftSolz workspace.

Better together

Pairs well with

FormsAnother drop-in widget for the same public site.

PaymentsCharge users once they are signed in.

Knowledge HubPut a chatbot behind a signed-in session.

One subscription covers every service.

Ship Customer Auth on your site today

Create a free workspace, install Customer Auth, and go live in minutes. 14-day trial on paid plans.

Start free View pricing