WeldAuth01
One shared story
Environments, JWKS, and sessions stay aligned — so your app and your MCP server speak the same identity language.
Part of WeldSuite
Auth that fits.
Built to connect.
Clerk-class authentication for WeldSuite — and for every product that needs users, orgs, machines, agents, and MCP-ready OAuth in one place.
01 — Work without the loose ends
Everything auth needs. Already working together.
Users are more than passwords. Machines need more than a shared secret. WeldAuth connects people, orgs, services, and AI agents on one foundation.
02
Move as one
Hosted auth, dashboard, and APIs share branding and domains. Ship like Clerk — without leaving the WeldSuite family.
03
Room to grow
Start with sign-in. Add orgs, API keys, M2M, agents, and dynamic OAuth when your product is ready.
Powerful on their own
Better as a platform.
Thoughtfully built auth surfaces. One shared data plane. A clearer way to ship.
Users & organizations
Password, magic link, OAuth, SAML. MFA, roles, and org memberships with Clerk-compatible permission checks.
API keys & M2M
User- and org-owned ak_ keys, plus machine secrets and scoped M2M tokens for service-to-service calls.
Agents & MCP OAuth
First-class agents with session-like JWTs, and dynamic client registration so MCP clients can connect securely.
Credential families
The right key for the job.
Distinct prefixes. Clear ownership. No guessing which secret belongs where.
pk_ / sk_Instance SDK keys
Talk to WeldAuth. Select an environment.
ak_User / org API keys
Long-lived secrets owned by a person or team.
msk_ / mt_Machines & M2M
Service actors minting scoped opaque tokens.
agsec_ → JWTAgents
Agent secrets mint short-lived sessions.
Your data. Handled properly.
Built for trust from day one.
Soft multi-tenant by design, environment isolation, and JWKS-verified tokens — ready for EU-first workloads.
Environment isolation
Dev, staging, and production as separate data planes — Clerk-like.
JWKS everywhere
User, agent, and OAuth access tokens verify the same way.
Auth host ready
Dedicated auth domains and application callbacks, Auth0-style.
Neon + Workers
API on Cloudflare Workers. Postgres on Neon. Web on Vercel.
Good to know
Questions, answered.
Is WeldAuth only for WeldSuite?
No. WeldSuite is the first customer, but WeldAuth is a general multi-tenant auth platform — other products can sign up and run their own instances.
How does it compare to Clerk?
WeldAuth aims for Clerk-class product surfaces (users, orgs, environments, machine auth, satellites/auth host) without claiming wire compatibility. You get a familiar model with room to extend for agents and MCP.
Can I run MCP servers on WeldAuth?
Yes. Enable dynamic client registration, publish authorization-server metadata, and let MCP clients register via RFC 7591 — then authorize with PKCE.
Where does my data live?
Production targets Neon Postgres with soft multi-tenancy. Hosted auth and dashboard deploy on Vercel; the API runs on Cloudflare Workers.
Free to explore. Ready when you are.
Create an application, grab your keys, and ship sign-in that looks like it belongs next to WeldMail and WeldCRM.