Auth & SSO

The Problem

Authentication starts simple and gets complicated fast. First it’s email/password. Then social login. Then your first enterprise customer wants SAML SSO. Then SCIM provisioning. Then MFA. Before you know it, you’re maintaining a full identity platform instead of building your product.

How Flux Handles It

Flux provides a complete identity layer that grows with you:

• Consumer auth: Email, social, passwordless, passkeys — all out of the box
• B2B organizations: Multi-tenant by default, with roles and permissions per org
• Enterprise SSO: SAML and OIDC with a self-serve admin portal for your customers
• Directory sync: SCIM provisioning so your customers’ IT teams stay in control
• MFA: TOTP, WebAuthn, and SMS — enforced per organization or globally

What Makes It Different

In other platforms, auth is an island. In Flux, auth is connected to everything:

• Entitlements-aware: Auth decisions include billing tier and feature access
• Tenant-scoped: Every auth event is tagged with organization context
• Audit-logged: Every login, logout, and permission change is recorded automatically
• Flag-integrated: Gate auth features (like MFA enforcement) behind feature flags

use flux_sdk::Flux;

let flux = Flux::init("your-api-key");
let user = flux.auth().verify_session(&token)?;

// Auth knows about billing
let can_use_sso = flux.entitlements().check(&user, "sso")?;

// Auth knows about flags
let show_passkeys = flux.flags().is_enabled("passkeys", &user);