PureIDP
Start building
Identity platform by PureSquare

Identity that disappears when it works.

Enterprise-grade authentication for teams that need SSO, MFA, and passkeys without the operational overhead. Built on open standards — OpenID Connect and OAuth 2 end to end.

Start buildingRead the docs
  • SOC 2 Type II
  • GDPR compliant
  • FIDO2 certified
3M+
users across PureSquare products
1 API
for login, tenants, admin, and billing
0
identity servers for your team to operate

Platform

Every way your users want to sign in. One clean API.

Hosted, themeable login out of the box — or drive every flow headlessly from your own UI. Either way, your app never touches the identity server directly.

  • Passkeys, first-class

    FIDO2/WebAuthn sign-in and headless passkey enrollment, so users never type a password on a device they own.

  • Passwordless OTP

    One-time-passcode login and signup in a single flow — two API calls from email to authenticated session.

  • Social sign-in

    Google and Apple login handled server-side by the platform — one redirect URI, no OAuth plumbing in your app.

  • Guest accounts

    Let users try your product anonymously, then upgrade to a full account later — history intact, sessions merged.

  • MFA & step-up

    Conditional OTP flows and per-route step-up enforcement, gated at the API — not left to each client to remember.

  • Hosted login, your brand

    A themeable sign-in experience served from your own origin. Edit colors, copy, and layout with the visual Theme Editor.

Multi-tenancy

Each tenant gets its own realm. You keep one control plane.

  • Isolated by design

    Every tenant is a fully isolated realm — users, roles, sessions, and keys never cross a boundary.

  • Provision in one call

    Create a tenant and get a branded, brokered, login-ready realm back — clients, flows, and SMTP wired automatically.

  • Delegated administration

    Tenant admins manage their own users, roles, and settings through a scoped API that can't reach anyone else's.

  • Shared identity, when you want it

    Broker tenants to a central identity realm so one account works across all your products — or keep them separate.

Developers

Two calls to a signed-in user.

Two SDKs and a plain REST API — all three speak the same surface, so you can start with an SDK and drop to raw HTTP whenever you need to.

  • TypeScript SDK

    @pureidp/sdk

    For the web platform — SPAs and Node backends. Typed flows for login, OTP, social, and guest upgrade, with sessions verified and refreshed for you.

  • KMP SDK

    PureIDPKit · iOS 14+

    Kotlin Multiplatform core with a native Swift surface: Keychain token storage, web-auth redirect handling, and the same flows as TypeScript.

  • REST API

    OpenAPI + webhooks

    Everything the SDKs do over plain HTTPS — any language, any stack. Full OpenAPI spec, plus webhooks for account and billing events.

login.ts
import { PureIDP } from "@pureidp/sdk";

const idp = new PureIDP({ tenant: "acme" });

// Passwordless, start to finish
await idp.auth.otp.start({ email });
const session = await idp.auth.otp.complete({ email, code });

session.accessToken  // verified, auto-refreshed

Entitlements

Your billing system stays the source of truth.

  • One webhook, always in sync

    Send the entitlement feed after every billing event; PureIDP grants what's present and revokes what isn't. No drift.

  • Entitlements in the token

    Products and plans land as claims your services can authorize on directly — no extra lookup on the hot path.

  • Every change, on the record

    A queryable history of who gained or lost which entitlement, when, and why — built for support and audit alike.

Get started

Ship sign-in this week. Own it for years.

Migrate existing users with zero downtime — resumable batch import, compatible response shapes, and your users never notice the switch.

Start buildingTalk to us