Introduction
Authio is an identity and access platform built on OpenID Connect and OAuth 2.0: sign-in, tokens and access control for your apps and APIs, hosted for you.
Authio handles everything between a person and your application: the sign-in screens, passkeys and multi-factor, the sessions, the tokens your APIs trust and the rules that decide who may do what. You configure it in the console, connect your apps with a standard OpenID Connect client or one of our SDKs, and Authio runs the rest.
Everything is organised in realms. A realm is an isolated tenant with its own users, applications, signing keys, sessions and policies, so production, staging and each of your customers can live side by side without seeing each other.
How it fits in your stack
Your app sends the person to Authio
When someone clicks Sign in, your app redirects them to the realm’s hosted login with a standard authorization request (authorization code flow with PKCE).
Authio signs them in
The hosted login runs the steps you configured for that client — password, passkey, a one-time code, a push approval on their phone — and enforces the realm’s policies along the way.
Your app receives tokens
Authio sends the browser back with a code that your app exchanges for an ID token (who the person is), an access token (what they may call) and, when you ask for it, a refresh token.
Your APIs verify the access token
Each API checks the token’s signature against the realm’s public keys (JWKS), its audience and its scopes or roles. No call back to Authio is needed for a valid token.
The building blocks
| Concept | What it is |
|---|---|
| Account | Your company on Authio: the subscription, the team that manages it and every realm it owns. |
| Realm | An isolated tenant with its own issuer, keys, users, clients and policies. |
| Client | An application that signs people in or calls APIs: a web app, a SPA, a mobile app, a service. |
| User | A person who signs in to a realm. One account per person per realm, shared by every client of that realm. |
| Roles and scopes | What a user or an application is allowed to do, carried in the tokens Authio issues. |
| Organization | A group of users inside a realm — typically one of your B2B customers — with its own members and roles. |
| Resource server | An API your tokens are issued for, identified by its audience. |
Each one has its own page in Core concepts.
Shared platform or dedicated environment
Most teams use Authio on the shared platform: you sign up, start a 14-day trial without a card and create realms right away. Teams that need their own infrastructure choose the Dedicated plan instead: Authio provisions a complete environment — API, console, database and cache — for that account alone, on its own domain, and the console becomes the place to watch and operate it.