Build B2B SaaS auth on .NET

The standard flow: one app, one call#

Almost every SqlOS host is one product. Describe it once and SqlOS derives the routes, token validation, metadata documents, client registration, and seeds:

builder.AddSqlOS<AppDbContext>(
    db => db.UseSqlServer(connectionString),
    options => options.UseSingleApplication("Acme", app =>
    {
        app.Origin = "https://acme.example.com";
        app.Api = "/api";                                     // resource id {Origin}/api
        app.Mcp = "/mcp";                                      // resource id {Origin}/mcp
        app.Brand(page => page.PrimaryColor = "#0f172a");     // hosted sign-in, or app.Headless("/auth/authorize") for your own UI
        app.Authorization(fga => /* resource types, permissions, roles */ fga);
    }));

The normal path is incremental:

1. Declare one application with Origin; hosted login and the dashboard work immediately.
2. Complete hosted login into your ASP.NET Core session.
3. Add Api to protect your application API.
4. Add Authorization only to data that needs fine-grained rules.
5. Add Brand or Headless, an Mcp server, social login, SAML SSO, MFA, and audit as requirements appear.

Second shape: many applications#

When other applications should sign in with your accounts — another browser app, a CLI alongside it, or a partner using "Sign in with Acme" — use ConfigureApplication with explicit client registrations. A separate frontend and API can still be one client application. Start there only when a second application exists.

The sidebar is grouped by product capability: host, sign-in, tokens, clients, MCP, organizations, directory, authorization, and operations. Start at Getting Started or the runnable examples.