Customer identity that doesn't get in the way.
Everything your product team needs to sign a user up, keep their account safe, and push the result into every downstream system that cares. Self-service registration, social login, MFA, email verification, password reset, and CRM provisioning — out of the box.
End-user flows
Every flow here is an implementation of an open standard, exposed over a JSON API. Your product can either use the hosted UI or call the endpoints directly from a custom front-end.
Sign-up & email verification
Configurable password policy, email verification with single-use tokens, and optional rate limiting per email and per IP to block bulk-register attacks.
Password + MFA
TOTP (Google Authenticator, 1Password), WebAuthn (hardware keys, Touch ID, Face ID), SMS one-time codes, and printable backup codes.
Social login
Google, Microsoft, Apple, GitHub, Facebook, LinkedIn, Amazon and more. Conditional on tenant configuration — a customer-facing tenant enables what it wants without touching code.
Password reset
Time-limited, single-use reset tokens delivered by email. Users who reset their password have all outstanding sessions invalidated automatically.
Brute-force protection
Configurable account lockout with exponential backoff. Locked accounts return the same "invalid credentials" error as unknown accounts, so an attacker can't tell what's real.
Profile & session management
Users can view active sessions, revoke them individually, enrol or remove MFA factors, and rotate their password — without raising a support ticket.
CRM provisioning
When a user signs in, WeldForge can push their identity into your CRM of choice. Field mappings are configured per tenant; dedupe is automatic; a single user never produces two records even across browsers and devices.
Salesforce
Contact upsert against the Salesforce REST API.
HubSpot
Contact upsert via HubSpot's CRM v3 API.
Microsoft Dynamics
Contact upsert via the Dynamics Web API.
Pipedrive
Person upsert through Pipedrive's REST API.
Integrating in your app
The simplest integration is the OIDC Authorization Code flow. Point your app at the tenant's OIDC endpoints:
https://sso.example.com/t/{tenant-slug}/.well-known/openid-configurationThis document lists every OAuth2 endpoint (authorize, token, userinfo, jwks, revoke, end-session) your OIDC library needs to configure itself automatically. WeldForge issues RS256-signed JWTs using a per-tenant signing key.
Prefer to build your own sign-in UI? Call /api/auth/login and /api/auth/refresh directly — both return a JWT your front-end can store and present on subsequent API calls.
requirePkce: true and no client secret. WeldForge
rejects an Authorization Code exchange from a public client that
doesn't present a matching code_verifier. Confidential
clients (server-to-server) keep a secret and use
client_credentials; both kinds can live under the
same tenant. See
Integrating an app with OIDC
for a worked example.
The roles claim — driven by SCIM groups
Every WeldForge access and ID token already carries a roles array. There is no separate claim-mapper to configure: the array is built from two existing primitives — Role records you create per tenant, and group-role mappings that bind a SCIM group to a role. SCIM-provisioned membership flows through automatically, so a user added to wb-admins in your upstream IdP gets "roles":["admin"] on the next token without a redeploy. The same mapping applies to every grant type, so JWTs minted for a SPA, a mobile app, or a backend service all carry the same role set. Downstream services validate the JWT with the standard issuer URI and read roles directly. See Integrating an app with OIDC for the full bootstrap.