Start with Udibo
Udibo gives you two ways to add authentication: connect your application to Udibo Identity, the managed service, or use @udibo/oauth2 to run authentication inside your own application. Choose who operates identity first; the rest of your setup follows from that decision.
Choose your path
| You want to… | Start here | You operate |
|---|---|---|
| Let Udibo manage sign-in, accounts, and recovery | Connect your first application | Your application, its sessions, and its data authorization |
| Replace an existing identity integration | Move an existing app | The rollout, identity mapping, and application changes |
| Own credential storage and run authentication yourself | Package quickstart | Your authentication service, persistence, email, and security operations |
| Give a coding agent the implementation task | Build with an agent | The integration decisions and review of its result |
You can use the package as the client of the managed service. Installing it does not require you to run an authorization server or build password-reset pages.
What the managed service takes care of
Your users sign in on your tenant's hosted pages. You configure the sign-in methods, account creation, and MFA policy; your application receives the result through an OAuth2 authorization-code flow.
Social sign-in, email codes and magic links, and MFA are configured in your tenant
Organizations group your customers; roles and permissions express what they can do in your application
Webhooks deliver events to your backend; the audit log helps you investigate activity
Your backend still protects your application's records. A valid session proves who someone is; it does not, by itself, give them access to another customer's data. The concepts guide explains that boundary with examples.
What the package gives you
@udibo/oauth2 supplies OAuth2/OIDC clients, authorization and resource servers, Hono integration, a backend-for-frontend (BFF), and React bindings. A BFF is your app's backend layer that keeps tokens on the server and gives the browser a session cookie.
The package's documentation index separates managed integration from app-owned authentication. Its known limitations and runtime support belong in your evaluation before you choose storage or deploy.
Availability and fit
Udibo Identity is in private beta. Start at Udibo for the current access path. The hosted guides assume you have beta access and a tenant; they do not promise immediate public registration. You can explore the package's local identity provider without a managed account.
The hosted service currently offers password, social, email-code, and magic-link sign-in, with TOTP MFA and recovery codes. Hosted passkeys, SAML federation, and SCIM provisioning are not available. If one is a launch requirement, evaluate an alternative that provides it today. The comparison guides explain the tradeoffs without treating planned features as available features.
Your first milestone
Aim for a browser sign-in that returns to your application, an authenticated API request, and a sign-out that ends the application's session. Once that works, add the capabilities your product needs and use the production checklist before inviting real users.
Next: Connect your first application.
Last verified 2026-09-06.