Enterprise auth, embedded in your database.
Branded login, social auth, SAML SSO, and fine-grained permissions — one NuGet package that runs in your app and lives in your database.
Everything between “Sign in” and a row of data
Three products' worth of surface area, one package. Each piece is live the moment you map the routes.
Sign in to YourProduct
Hosted login, your brand
Server-rendered signup, login, and logout on your domain — logo, colors, and providers configured from the dashboard.
Ship the login pageEnterprise SSO in an afternoon
SAML and OIDC per organization. Hand your customer the ACS URL, import their metadata, and home realm discovery routes by email domain.
See the SSO flowPermissions that cascade
Model your real hierarchy, grant a role at any node, and access inherits downward. Checks fold into EF Core queries as a WHERE clause.
Explore FGAAuthorization isn’t an API call.
It’s a WHERE clause.
Other stacks fetch rows and then ask a policy service about each one. SqlOS folds the access check into the query plan — filtering, sorting, pagination, and permissions in one round-trip to your SQL Server.
var projects = await db.Projects
.Where(await fga.BuildFilterAsync<Project>(user.Id, "projects.read"))
.OrderBy(p => p.Name).Take(20) .ToListAsync(); // one query- per page at 1.2M rows
- 3.47ms
- per page at 1.2M rows
- point checks, D=10
- <1.5ms
- point checks, D=10
- bounded, N-free
- O(k·D)
- bounded, N-free
And a control plane you don’t have to build
The dashboard ships in the package — orgs, users, sessions, providers, grants, audit, and a live access tester at /sqlos.
Your auth server is one package away
Install it, map the routes, run the Todo sample. Everything on this page is in the box.