Users, groups, roles, permissions.
Synced from Entra ID.
Organize users into security groups. Assign roles with fine-grained permissions. Sync directories from Entra ID, Okta, or Google Workspace via SCIM. One source of truth for who can do what — in your app, in the cloud, at the kernel.
The identity hierarchy
Users belong to groups. Groups carry roles. Roles grant permissions. Permissions protect everything — APIs, cloud resources, infrastructure.
People who access your app. Created via signup, SSO, SCIM, or API.
Collections of users. Synced from Entra ID or managed manually. Carry roles.
Named sets of permissions. Assigned to users directly or via groups.
Granular actions like read:patients, write:notes, deploy:production.
SCIM sync — real-time directory from Entra ID
User created in Entra ID? Appears in AuthFI in seconds. User deactivated? Sessions revoked immediately. Group membership changed? Roles update in real-time.
Entra ID
Microsoft Entra ID (formerly Azure AD). SCIM 2.0 provisioning app. Sync users, groups, membership in real-time.
Okta
Okta SCIM provisioning. Push users and groups to AuthFI. Deprovisioning blocks access instantly.
Google Workspace
Google Workspace directory sync. Organizational units map to groups. Automatic provisioning and deprovisioning.
Live SCIM sync log
Every directory change is logged with source, action, and enforcement status.
| TIME | SOURCE | EVENT | DETAIL | STATUS | LATENCY |
|---|---|---|---|---|---|
| 10:30:01 | Entra ID | User created | alice@acme.com | synced | 1.2s |
| 10:30:02 | Entra ID | Group add | alice → Engineering | synced | 0.8s |
| 10:31:15 | Entra ID | User updated | bob@acme.com (title changed) | synced | 0.9s |
| 10:32:00 | Entra ID | User deactivated | charlie@acme.com | synced | 1.1s |
| 10:32:01 | AuthFI | Session revoked | charlie@acme.com (all sessions) | enforced | 0.3s |
| 10:33:00 | Entra ID | Group removed | dave → DevOps | synced | 0.7s |
RBAC that flows everywhere
Define roles once. Permissions enforce at every layer — your app (SDK), your infrastructure (eBPF agent), and your cloud (GCP/AWS). One model, everywhere.
Permission checks in code
SDK middleware reads JWT, checks permissions. Unauthorized requests get 403 before hitting your route handler.
// 403 if user lacks permission
Kernel-level enforcement
eBPF agent reads roles from JWT, enforces access policy at the kernel. Unauthorized packets dropped in ~45us.
roles: [doctor] MFA: required
Cloud role mapping
AuthFI groups map to cloud IAM roles. Group "devops" gets GCP roles/editor. No separate cloud identity needed.
group:viewers → GCP roles/viewer
Organization isolation
Each organization has its own directory — users, groups, roles, permissions. Complete isolation. Delegated admin. Ideal for B2B SaaS where each customer is an org.
Complete isolation
Users in Org A can never see data from Org B. Groups, roles, and permissions are scoped to the org. JWT includes org_id for server-side filtering.
Delegated admin
Each org has its own admins who manage users, groups, and roles within their org. They can configure SSO, MFA, and branding. They cannot access other orgs.
Full API + SDK for everything
Every operation available via REST API and SDKs. Create users, manage groups, assign roles, check permissions programmatically.
SDK permission check — one line
app.get('/api/patients',
auth.require('read:patients'),
handler
);
// Check in handler
if (req.user.can('write:notes')) {
// allowed
}
r.With(
auth.Require("read:patients"),
).Get("/api/patients", h)
// In handler
if auth.Can(ctx, "write:notes") {
// allowed
}
@auth.require('read:patients')
def get_patients():
pass
# In handler
if request.user.can('write:notes'):
# allowed
Offboarding in seconds, not days
Deactivate a user in Entra ID. AuthFI revokes all sessions, blocks all access, removes cloud permissions — automatically.
Related features
Available on Free and above. See pricing →
One platform. Every identity layer.
Free to start.
Free for 5,000 users. Upgrade when you're ready.
Start building free →