Add email and password, magic links, and Apple, Google or LinkedIn sign-in to your app, with every native token verified on the server.
Every task works three ways, and all of them change the same project. Here's one: let people sign in with Google.
The Anythink dashboard
Add the Google credentials once per project.
The Anythink CLI
The client ID and secret are prompted for, not passed as flags, so they stay out of your shell history.
$ anythink oauth google configure$ anythink oauth google status$ anythink fetch /auth/v1/providersClaude, through MCP
Keep the secret out of chat: set it in the dashboard or CLI, then ask the assistant to check the setup.
you › “Is Google sign-in configured on this project? Which sign-in buttons should my login page show?”
Native sign-in
Apple, Google and LinkedIn tokens are checked against each provider's published keys, and the token's subject must match the user identifier your app sent. A forged or swapped token is rejected.
Stable identity
Anythink links each provider's stable subject ID to the user, so a returning user is matched behind Apple's private email relay or after changing their email address.
One session
The token your app receives works on every entity endpoint, and the Anythink MCP server authenticates with the same user JWT, so permissions apply the same way to people and assistants.
Access
Every user has a role with per-entity permissions, and row-level security limits which records they reach, including group-scoped reads for teams.
Email and password, magic links, native and web social sign-in, and JWT sessions, all on the same users your data model already links to.
Register users, confirm their email, reset passwords and send one-time magic links from the built-in auth endpoints. Password sign-in waits until the email address is confirmed.
Your iOS or Android app sends Anythink the provider's identity token. Anythink checks it against the provider's published keys and cross-checks the subject ID before it signs anyone in. Native sign-in needs your app's client IDs, not a client secret.
For browser sign-in, Anythink runs the authorise and callback flow for each provider you enable, using PKCE where the provider supports it, and records UTM and referrer details when a user signs up.
Sign-in returns a JWT access token and a refresh token. Refreshing issues a new pair, logout revokes the refresh token, and transfer tokens hand a session from one app or device to another.
Every signed-in user is a record you can link to any entity with a user field, then use in roles, row-level security and workflows.
GET /auth/v1/providers returns the sign-in methods this project has configured, so your login page shows only the buttons that will work.
In practice
POST https://api.my.anythink.cloud/org/{org_id}/auth/v1/token Content-Type: application/json { "email": "alice@example.com", "password": "<password>" }
How it works
Email and password and magic links use the built-in auth endpoints. Turn on Apple, Google or LinkedIn under Settings › Social Sign-In with your client IDs.
Your login page calls /auth/v1/providers and renders only the methods this project has configured.
Web apps run the OAuth redirect, with PKCE where the provider supports it. Mobile apps send the provider's identity token to /auth/v1/native/{provider}, which verifies it and creates the user on first sign-in.
Send the access token as a Bearer token on each API call and refresh it when it expires. In React, the open-source SDK's AuthProvider and useAuth handle this for you.
Give the user a role, link records to them, and let row-level security filter what they see.
Follow the guide
Create the credentials in Google Cloud, add them to the project and people can sign in with Google.
Read the social sign-in guide →Email and password (with email confirmation and password reset), magic links, native Apple, Google and LinkedIn sign-in for mobile apps, and web OAuth sign-in for the providers you enable. Every method ends with the same JWT access and refresh tokens.
Turn on Apple under Settings › Social Sign-In in the Anythink dashboard and list your app's client IDs. Your app sends the identity token and user identifier from Sign in with Apple to POST /auth/v1/native/apple. Anythink verifies the token against Apple's published keys, checks the subject matches, and returns a session.
Apple only shares the user's name on the first sign-in, so send given_name and family_name on that call.
Sign-in returns a JWT access token for API calls and a refresh token. Send the access token as a Bearer token. When it expires, POST the refresh token to /auth/v1/refresh for a new pair. Logging out revokes the refresh token.
Yes. Every user has a role, and roles carry permissions per entity, such as orders:read. Row-level security then limits which records a user reaches. Users can also belong to groups, so team members can read their team's records while staff-only records stay private.
Still have questions?
Get in TouchEvery feature reads from the same data model, so each one you add works with the rest.
The dashboard, the CLI, MCP and the SDK, plus guides for moving from other platforms.
How founders, agencies and enterprise teams use Anythink.
Guides and reference at docs.anythink.cloud.
Create an account and start building
