Ship enterprise-ready auth this afternoon.
SSO, user management, and fine-grained authorization for your app — on infrastructure that never leaves the EU. No CLOUD Act exposure. NIS2 and DORA-ready.
- 10
- Building blocks
- 240+
- API operations
- EU-only
- Data residency
- Zero
- US CLOUD Act exposure
One platform
Every building block for customer identity
Ship the blocks you need now and add the rest later. Each one is a documented API on the same platform.
Enterprise SSO
Let customers sign in with Okta, Entra ID, Google Workspace, or any SAML or OIDC provider.
Learn moreSocial login
Add Google sign-in without writing OAuth glue yourself, with more providers on the way.
Learn morePasswordless & MFA
Turn on passkeys, magic links, one-time codes, and TOTP or hardware tokens.
Learn moreUser management
Store, search, and edit your users and their profiles through one API.
Learn moreOrganizations (B2B)
Give each customer organization its own members, roles, and login rules.
Learn moreAuthorization
Enforce access with roles and fine-grained, relationship-based permissions.
Learn moreDirectory sync (SCIM)
Provision and de-provision users straight from your customers' directory.
Learn moreActions & Hooks
Run your own logic during login and stream every event to your systems.
Learn moreAudit & compliance
Get tamper-evident audit logs, SIEM streaming, and built-in DSAR and consent tools.
Learn moreMigration
Move users off Auth0 or Cognito with password and profile import.
Learn more
How it fits
Your app on one side, every identity provider on the other.
Your application speaks one standard protocol to Thoryn. Thoryn brokers the rest — enterprise directories, social login, and its own user store.
Your app
OIDC / OAuth 2.0
Thoryn
Broker and user store
Any identity provider
- Okta
- Microsoft Entra ID
- Google Workspace
- SAML / OIDC
- Email and password
One integration. Add or swap providers without touching your app.
Sovereign by default
Your users' data never leaves the EU
Sovereignty is not a tier or an add-on. It is how the platform is built and where it runs.
EU-only residency
Every request, key, and log stays on EU-only infrastructure. Data does not leave the region.
No CLOUD Act exposure
Dutch incorporation and EU hosting keep your data outside US CLOUD Act reach.
NIS2 and DORA-ready
Controls map to NIS2 and DORA, with evidence you can hand to auditors.
Keys in Vault, not the app
ES256 signing keys are custodied in Vault and OpenBao, never in the application.
Regulatory pressure keeps rising
Data table
| Regulation | 2024 | 2025 | 2026 | 2027 |
|---|---|---|---|---|
| NIS2 | Preparation | Enforced | Enforced | Enforced |
| DORA | Preparation | Enforced | Enforced | Enforced |
| CRA | — | Preparation | Preparation | Enforced |
| GDPR | Enforced | Enforced | Enforced | Enforced |
NIS2, DORA, and the Cyber Resilience Act raise the bar for where identity data lives and how it is secured. EU-sovereign auth is the baseline, not the upsell.
Developer-first
One API, one CLI, no lock-in
Wire your first login this afternoon, then automate the rest from your own toolchain.
One REST API
A single /api/v1 surface covers every capability, with generated reference docs.
The thoryn CLI
Script tenants, clients, and users from the thoryn command-line tool.
Actions & Hooks
Extend login with your own code and subscribe to the events you care about.
Open standards
Built on OAuth 2.0, OIDC, PKCE, PAR, and DPoP. No proprietary protocol.
See it in code
Register an application in one call.
Every capability sits behind one /api/v1 REST surface, with camelCase JSON and OAuth 2.0 bearer tokens. The same request runs from cURL, fetch, or raw HTTP — the client secret comes back once.
Register an OAuth application
curl -X POST https://api.thoryn.org/api/v1/applications \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"displayName": "Acme Portal",
"redirectUris": ["https://app.acme.example/login/oauth2/code/thoryn"],
"scopes": ["openid", "profile", "email", "offline_access"],
"grantTypes": ["authorization_code", "refresh_token"],
"clientType": "confidential"
}'const res = await fetch(
"https://api.thoryn.org/api/v1/applications",
{
method: "POST",
headers: {
Authorization: `Bearer ${token}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
displayName: "Acme Portal",
redirectUris: ["https://app.acme.example/login/oauth2/code/thoryn"],
scopes: ["openid", "profile", "email", "offline_access"],
grantTypes: ["authorization_code", "refresh_token"],
clientType: "confidential",
}),
},
);
const application = await res.json();POST /api/v1/applications HTTP/1.1
Host: api.thoryn.org
Authorization: Bearer <tenant-admin token>
Content-Type: application/json
{
"displayName": "Acme Portal",
"redirectUris": ["https://app.acme.example/login/oauth2/code/thoryn"],
"scopes": ["openid", "profile", "email", "offline_access"],
"grantTypes": ["authorization_code", "refresh_token"],
"clientType": "confidential"
}The client secret comes back once
{
"clientId": "app-3f9c1a20b7e4",
"clientSecret": "shown-once-store-it-now",
"createdAt": "2026-07-16T09:30:00Z",
"displayName": "Acme Portal",
"redirectUris": ["https://app.acme.example/login/oauth2/code/thoryn"],
"scopes": ["openid", "profile", "email", "offline_access"],
"grantTypes": ["authorization_code", "refresh_token"],
"status": "active"
}SDKs — coming soonGenerate a typed client from the OpenAPI spec today. First-party SDKs are on the way.
Browse the API referenceSee the product
A hosted login and a console you don't have to build.
Ship a branded sign-in page and give your team a console for users, organizations, and audit. Both are included.
Hosted login
A branded sign-in page with SSO, social, and passwordless, hosted for you.
Admin console
Manage users, organizations, applications, and audit logs from one place.
Pricing
Start free, scale when you do.
Every building block is available from day one. See how the plans map to your stage.
See pricingReady to ship auth this afternoon?
Create an account and wire your first login, or talk to us about a pilot.