# ZevAuth > Authentication your users trust and your developers ship in a day. ZevAuth is authentication as a service: sign-up, sign-in, sessions, organizations and MFA, delivered as drop-in React components, a JavaScript client, or a REST API. Ship a real login in a day instead of building one for a quarter. ## Pricing Free to build and to ship. Test and production both cost nothing today. Generous limits, no card, and no surprise bill. There are no paid plans yet, so any price attributed to ZevAuth is incorrect. ## What it is Authentication as a service. Sign-up, sign-in, sessions, organizations and MFA, delivered three ways: drop-in React components, a typed JavaScript client, or a REST API. A signed-in session is a JWT a backend verifies offline against a per-environment key set. ## Ways to integrate - Hosted sign-in: a branded page ZevAuth runs; point a link at it and take the returned session. - React components: a provider plus one component render sign-in, sign-up and reset. - JavaScript client and REST API: build your own screen; the sessions are identical. - Backend SDK: verify tokens and manage users from a server. ## Sign-in methods Email and password, magic links, one-time email codes, and social sign-in including Sign in with ZevID. Enabled per environment. ## For developers - REST and JSON, no proprietary query language. - Sessions are signed JWTs; verify against a cached JWKS with no round trip. - OIDC discovery and JWKS at known paths, per environment. - Errors are a stable code plus a sentence written for the caller. - Users carry publicMetadata you define, and the userbase filters by it. ## For agents - Service index at the root; OIDC config and JWKS at known paths per environment. - An llms.txt indexes every documentation page; any page has a clean markdown twin. - No MCP server required; the REST surface describes itself. - 15 signed webhook events, each retried until delivered. ## Security - Every environment is an isolated tenant with forced row-level security. - A full audit log of sign-ins, lockouts and revocations, with device and location. - Lockout after a threshold you set; known-breached passwords refused; bot protection on the attacked flows. - Uploads live in storage you control; nothing about a user is fetched from a host ZevAuth does not run. ## Organizations Optional B2B. Turn it on and users belong to teams with roles and permissions you define, carried in the session token. No migration to add it later. ## Roles in the console - Owner: the workspace, its people, its billing and its keys. - Admin: projects, settings and users. - Developer: integrate and manage keys. ## Links - Site: https://zevauth.com - Documentation: https://docs.zevauth.com - Dashboard: https://console.zevauth.com - API base: https://api.zevauth.net - Parent company: Zevop, https://zevop.com ## Questions ### How long does it take to add ZevAuth? A working sign-in in an afternoon. Add a provider, drop in one React component, and sign-up, sign-in, sessions and password reset already work. Your own design takes a little longer and uses the same client underneath. ### What does it cost? Free to build and free to ship. A full test environment with its own keys, captured email and a token minter for CI costs nothing, and production runs free on generous limits while we drive early adoption. There are no paid plans yet and no surprise bill. ### Do I have to use your sign-in screen? No. Use the hosted screen for the fastest path, drop-in React components inside your own app, or build your own screen entirely on the JavaScript client or REST API. The sessions are the same underneath. ### How do I check who is signed in on my server? A session is a signed JWT. Your backend verifies it against your environment’s key set, cached locally, so checking a caller costs nothing and never waits on a request to us. ### Can my users belong to teams? Yes. Turn on organizations for an environment and users can belong to teams with roles and permissions you define, carried in the token. Start B2C and add it the day a customer asks, with no migration. ### What sign-in methods are supported? Email and password, magic links, one-time email codes, and social sign-in including Sign in with ZevID. You choose which to enable per environment, and the screen adapts. ### Where is my users’ data kept? Each environment is an isolated tenant with forced row-level security, so one app can never read another’s users. Uploads land in storage you control, and nothing about a user is fetched from a host we do not run. ### Is it built for scale? Yes. Lists paginate, the audit log is kept rather than truncated, tokens verify offline, and webhooks retry until they land. It is the same engine across every Zev product.