Your login page,
without building one.
The free, LLM-friendly Auth0 alternative. No AuthCog account needed - the default Google and email magic link sign-in just work. Send visitors to AuthCog, they sign in with the provider they already use, your server gets a verified email.
Building with a coding agent? Point it at /AGENTS.md and it has every rule it needs.
How a sign-in works
Three hops. Your server never sees a password or a provider token.
You send them over
Redirect with a one-time challenge you keep in the session.
auth.authcog.com/d:your-domain.com
They sign in
With any provider you enabled, on a page that carries your brand.
Google · GitHub · Microsoft · email
You get a verified profile
Check the challenge, then swap the single-use hash for the identity.
your-domain.com/authcog?callback=
One redirect out, one request back.
No SDK, just plain HTTP from any language.
Your app sends
# send the visitor, with a challenge kept in their session GET https://auth.authcog.com/d:your-domain.com?state=RANDOM # they come back to you GET https://your-domain.com/authcog?callback=HASH&state=RANDOM # check the challenge, then exchange from your server GET https://auth.authcog.com/d:your-domain.com?user=HASH
Your server gets back
200 OK
{
"email": "[email protected]",
"name": "Ada Lovelace",
"avatar": "https://...",
"provider": "google",
"realm": null,
"issuer": "auth"
}
What you get
- Realms
- One per tenant at {name}.authcog.com - its own signing secret, providers, branding and consent screen.
- Providers
- Google, GitHub, Microsoft and email out of the box. Any OpenID Connect or OAuth2 IdP. Cloudflare Access, Google IAP or any signed JWT header.
- Consent
- Users explicitly authorize each relying site. GDPR-friendly, audit-ready.
- Callback hash
- Single-use, expires in 5 minutes, bound to the domain it was issued for.
- Local development
- Pass the port for localhost and *.lvh.me hosts: /d:my-app.lvh.me/p:8000
- Coding agents
- Every rule above, in one file your agent can read: AGENTS.md
Free for everyone.
No plans, no limits. Enter your app's URL to open its sign-in page.