More than a sign-in form.
Finomium gives your ops team full auth and team management - OAuth2/OIDC, MFA, SSO federation, and role-based access - behind the same API as workflow and email.
curl -X POST https://api.finomium.co/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "ops1@acme-isp.test",
"password": "••••••••"
}'
# {"accessToken":"eyJ...","refreshToken":"...","expiresAt":"2026-09-01T12:15:00Z"}Email + password
Bcrypt-hashed passwords, short-lived JWT access tokens, and rotating refresh tokens - the baseline every account starts with.
Multi-factor auth
TOTP authenticator apps and WebAuthn/FIDO2 passkeys as sign-in factors, plus one-time recovery codes if a device is lost.
SSO & federation
Sign in with Google, Microsoft Entra ID, or any OIDC provider - with just-in-time account provisioning. Direct LDAP/Active Directory bind too.
OAuth2/OIDC server
A real authorization server: PKCE-mandatory /authorize, token introspection and revocation, dynamic client registration - not a toy.
Teams & invites
Invite teammates into your tenant by email, grant co-admin, and let them accept via a single link.
Role-based access
Seeded User/Admin/Platform Admin roles, plus fully custom roles you define and assign per user.
API keys
OAuth2 client-credentials clients for service-to-service calls - create and revoke them right from the console.
Session control
Revoke one session or sign out everywhere, with RP-initiated and back-channel OIDC logout for connected apps.
A BFF for SPAs, a session bridge for everything else
Single-page apps get a first-class Backend-for-Frontend flow (sign-in → callback → opaque session cookie → sign-out) so tokens never touch the browser. Building your own sign-in form instead? A session-bridge endpoint turns a token you already minted into an OIDC-recognized browser session, so custom UIs still play by the same rules.