newauth replaces passwords and second-factor devices with something simpler — users click secret spots on images. Works with your existing stack.
THIS IS WHAT YOUR USERS WILL SEE
How it works
No passwords to remember. No authenticator app. No SMS code. Users pick secret spots on images once — then just click to sign in.
Users pick a secret location on each of their assigned images. They confirm it a few times to build muscle memory. Takes 2–3 minutes per session.
At login, two images appear. The user clicks their secret spots. newauth validates the location against their stored pattern and issues a signed token.
Here is what's actually happening behind that click.
Any standard OIDC or SAML library reads the resulting token — identity, name, authentication strength — exactly like any other identity provider.
None of this touches your existing user database or access policies. Here’s how it plugs in.
Integration options
You don’t need to replace your existing stack. newauth slots in at whatever level makes sense for your organisation — from a single API call to a full sign-in replacement.
Keep your existing login (username & password, LDAP, or any custom auth). Show “Sign in with newauth” as an additional option next to your existing login form. Users who set up newauth use it; others continue with passwords.
Good for gradual migration — no forced change, adoption happens naturally.
If you already use an identity or SSO platform (e.g. Okta, Azure AD, Ping, Keycloak, Auth0, ADFS), add newauth as an external identity source in its admin console — usually just a URL and a few clicks. Your users see “Sign in with newauth” on your existing login page — the platform handles the rest.
No code changes to your apps. The platform keeps managing sessions and access policies.
Make newauth your identity provider. Users sign in exclusively through image clicks — no passwords, no MFA device. Your apps point their OIDC library (Spring Security, Passport.js, Auth.js, django-allauth…) at newauth’s discovery document and receive standard tokens.
Best for new apps or teams ready to drop passwords completely.
Keep your full existing login flow untouched. When you need proof of presence, send the user's browser to newauth for a quick image click — they're bounced right back to your redirect URL with the result. Verify it with one API call.
Two steps, both simple: redirect out for the click, one API call back. Nothing in your existing login changes. Useful for financial approvals, data exports, config changes, bot authorization gates, or anywhere you need proof an actual person was there at that moment.
/vn/sso/flake/verify. Works alongside any existing auth system (LDAP, SAML, proprietary).No AD, no Okta, no existing SSO? newauth can be your entire authentication layer from day one. Users are created in newauth — it is the source of truth for identity, not just a layer in front of something else.
Your apps receive standard OIDC tokens. You manage roles and permissions in your own database. Enterprise-grade sign-in without the enterprise-grade setup.
Paste this URL into any OIDC-compatible identity platform (Okta, Azure AD, Keycloak, Ping, Auth0…) to add newauth as an identity source in minutes. No code required.
Paste this URL into any SAML-compatible platform (ADFS, Shibboleth, Ping, Okta…) to add newauth as a SAML identity provider. No code required.
Every credential system can be measured. Here is how image-click sign-in compares to the strongest password your policy can enforce.
EvR9L@i!#76y — mixed case, digits, symbolstester1 has weathered millions of real break-in attempts.
Try it yourself — type tester1 on our
sign-in page.
Why newauth
Passwords get breached. Phones get lost. Authenticator apps cause helpdesk calls. newauth removes all of that.
No password, no code, no authenticator app, no hardware token. Users sign in from any device by clicking their secret spots — the whole login is just a few taps.
First few sessions take a few minutes each to set up. After that, signing in takes seconds — and gets faster as muscle memory builds.
newauth handles authentication only. Your directory (Active Directory, LDAP, Azure AD), group policies, and access controls stay exactly where they are.
OIDC discovery document, JWKS endpoint, Authorization Code + PKCE - or SAML 2.0 metadata and signed assertions. Any standard client library works out of the box, whichever your stack already speaks.
Each application gets a different user ID. Users can’t be tracked across your apps even if they use the same newauth account.
Pricing
Priced per active user each month - anyone who signs in at least once. Sign-ins are unlimited, and every plan includes the full sign-in stack: image-click authentication, session validation, and step-up. No SMS or one-time-code infrastructure to run or pay for - that whole line item disappears.
Billing is graduated — you pay each band’s rate only for the users in it, so your rate per user drops as you grow, never jumps. Save ~17% with annual billing.
Privacy by design
A username (treated like a password — hashed, never stored in clear text), a set of image click patterns, and a pairwise identifier per application. No email address required. No real name required.
We cannot tell that Alice from Acme Corp. is the same person as Alice from CoolWidgets Inc. — not because we promise not to look, but because the architecture never connects those dots.
A pairwise sub — unique to your application. The same user gets a completely different sub on every other app, even other apps under your own brand. Sites cannot correlate users across applications by design.
Also: optional name and username if the user consents, and an authentication strength indicator (acr). For presence checks, a per-sign-in flake_hash - proof that a live person who knows the secret spots was present at that moment. A flake is different every time, and on its own identifies no one.
Unlike other SSO providers, newauth cannot profile which sites your users visit — pairwise identifiers are on by default, not an opt-in.
Create a brand account, register your first application, and add the button to your site. Takes about 15 minutes.
Create a brand account → Have Questions?