Auth for one
Secure your personal apps and admin dashboard
No passwords. No config. No API keys. No account required. Two lines of code, it just works.
npm i isitmeimport { IsItMe } from "isitme/react";
<IsItMe>
<h1>Admin dashboard</h1>
<p>Secret tools here...</p>
</IsItMe>
// Not you? → shows passkey login
// You? → renders your contentWorks with
Auth can be a real pain.
Setup
- Sign up for auth providers
- Get API keys
- Configure their dashboard
- Wire up middleware and callbacks
- Build a login UI
- Send password reset emails
Logging in
- "Forgot my password" — again
- Recovery codes you'll lose
- SMS codes that don't arrive
- Can't log in from a new device
- "Check your email" loops
Security
- Passwords leaked in breaches
- Credentials phished on fake sites
- Tokens to rotate, sessions to expire
- Shared secrets crossing the network
- "I use the same password everywhere"
IsItMe keeps things simple
One user. One fingerprint. No passwords, no codes, no secrets. Your passkey is synced across devices, bound to your domain. Done.
Use it your way
React components
Drop-in components
Wrap your content with <IsItMe>. Authenticated? Renders children. Not you? Shows a passkey prompt. No state, no logic, no routing.
import { IsItMe } from "isitme/react";
<IsItMe>
<AdminDashboard />
</IsItMe>import { isItMe, signin, logout } from "isitme";
const isSuperAdmin = await isItMe();
isSuperAdmin
? <><a href="/dash">Dashboard</a><button onClick={logout}>Logout</button></>
: <button onClick={signin}>Sign in</button>Browser functions
Call functions directly
signin() handles everything — first visit registers a passkey, every visit after logs in. isItMe() checks the session silently. Use them anywhere: vanilla JS, Vue, Svelte, whatever.
Server SDK
Protect routes on the server
One line of middleware for Express, Next.js, or Hono. Handles registration, login, sessions, and route protection.
// Express
import { isitme } from "isitme/express";
app.use(isitme());
// Next.js
import { isitme } from "isitme/next";
export const middleware = isitme();See it in action
Built-in UI components handle the entire flow. Your users see a passkey prompt — that's it.
Create your passkey
Register a passkey to secure this app.
Built-in auth screen
triggers
Touch ID
Sign in to your-app.com
Native passkey prompt
How people use IsItMe
Admin sections
Lock down /admin without a whole auth system.
App dashboards
Infos and tools to manage your app. Analytics, settings, internal ops.
Unreleased features
Protect features that aren't publicly launched yet. Show conditional content only you can see.
Vibe-coded apps
Finance trackers, health logs, home automation — apps you built entirely for yourself.
2FA for your admin
Add a biometric layer on top of your existing auth. Safer than if (email === admin) and simpler than rolling a full 2FA system.
Open-source tools
Your users can secure their self-hosted instance instantly. No backend server, no external auth service, no SMTP setup.
If there's stuff only you should see, that's what this is for.
Safe by design. Nothing to steal.
No passwords. No API keys. No tokens on our servers. Your fingerprint or face never leaves your device — isitme only stores public keys, which are useless without your hardware. The attack surface is tiny by design.
Your biometrics stay on your device — we never see them
We only store public keys — worthless to an attacker
Each login is a cryptographic challenge bound to your domain
No passwords, no emails, no codes, no shared secrets ever cross the network
Already have auth in your app? isitme works as an extra layer — like an easy 2FA for your admin pages.
Built the protocol behind passkeys that works on every major platform. Phishing-resistant by design.
Learn moreFree, no accounts required
No signup required. No usage limits. If your project makes money, a one-time license keeps isitme alive.
Free
For side projects, experiments, and pre-revenue apps.
- Unlimited origins and namespaces
- Cloud-hosted credentials
- No signup required
- No account needed
- Self-host if you want
Supporter
For projects that generate revenue. Pay once, auth forever.
- Everything in Free
- Lifetime license — no renewals
- Keeps isitme free for everyone
- Priority support
Commercial
Required for companies with $100K+ in revenue or investment. Unlimited domains, SLA, and dedicated support.
- Everything in Supporter
- Unlimited domains
- SLA guarantee
- Dedicated support
Advanced: self-managed storage
Want to manage credential storage yourself? Run the SDK with a local file, env var, SQLite, or a custom adapter. You own the keys, control the infra, and can reset or manage multiple accounts on your terms.
- •Local file, env var, or custom adapter
- •No telemetry, no phone home
- •Easier reset and multi-account management
- •Free and open source (Apache 2.0)
Frequently asked questions
Auth shouldn't be a project.
One line of code. No config. Ship it.
npm i isitme