Havenkey
Get started

User authentication

Every way in.
Guarded by default.

Drop-in authentication with the whole surface area already covered — sessions, recovery, and abuse handling — so the people using your product are safe on day one.

Start building free

SOC 2 Type 2

Havenkey holds its infrastructure to independent audit on a rolling basis, so the records your customers trust you with stay exactly where they belong.

HIPAA

Covered workloads are supported under the Health Insurance Portability and Accountability Act, which means regulated user records are safe to keep here.

Bot & brute-force detection

Let Havenkey watch the attack surface — credential stuffing, scripted signups, volumetric abuse — while your team keeps shipping product.

Password leak protection

Enforce the character policy your risk team asked for, and screen every new credential against the BreachIndex corpus automatically.

Portrait of a verified account holder — photo by Thanh Xuan Nguyen Ly on Pexels

Social sign-in

Add high-conversion social sign-in
to your product in an afternoon

When it is offered, 61% of people reach for a provider they already trust instead of typing a password. Havenkey turns that into a two-line change.

C H J K N V O S P A B W

Convert faster

Social sign-in clears in about 1.4 times the speed of a typed password, and 4.7 times the speed of a mailed magic link.

One-call integration

Provider quirks, redirect edge cases, and refresh-token rotation are handled behind the component, not in your controller.

Pick your providers

Havenkey ships adapters for the identities your users already maintain, and adds new ones when a customer asks for them.

Automatic account linking

If someone returns through a different provider, the identity is matched to the existing account instead of quietly duplicating it.

Havenkey components

Pre-built components,
ready for everything

Simply add <AuthGate />, <SignUpFlow />, <AccountMenu />, <ProfilePanel /> anywhere in your component tree. Users stay on your own domain, and every token in the UI is yours to override.

Explore the component library

Sign in to Larkspur Labs

Welcome back — pick up where you left off.

MMeridian CCorvo
or

Email address

Continue

Multi-factor

MFA is still the cheapest
way to stop takeovers.

Shut down 96.8% of account takeovers before they land, at the level of assurance your users already meet everywhere else.

  • SMS passcodes. A short numeric handshake delivered to a verified phone, freshly generated and rotated on every attempt.

  • Authenticator apps (TOTP). Time-based codes generated on the device itself, with clock-drift tolerance and replay protection built in.

  • Hardware keys. Physical possession as the second factor, cryptographically bound to your origin so a phished code is worth nothing.

  • Recovery codes. A one-time fallback set, generated at enrollment and burned the moment it is used.

Passwordless

Move people into your
product in seconds.

Retire forgotten passwords, and the credential-stuffing traffic that always follows them.

  • Social sign-in. An identity the person already maintains, carried across every one of your surfaces on a single trusted account.

  • Magic links. A single-use URL that opens the session directly, scoped to the device that asked for it and nothing else.

  • Email OTP. A short code sent to the inbox on file, valid for one attempt inside one narrow window.

  • SMS OTP. The same one-time flow, delivered to the number that was already verified against the account.

Enterprise SSO

Wire up SAML and OpenID Connect
without writing the plumbing

Skip the weeks that go into hand-rolling assertion parsing and metadata exchange. In Havenkey, a compliant SAML connection is a form your admin fills out once.

Connection details Service provider details Identity provider information
Enterprise SSO

Advanced security

Take the security burden
off your shoulders

Working with Havenkey means adopting a posture where security, privacy, and compliance are treated as part of the product surface rather than a checklist bolted on at the end.

Pen tests & source review

Havenkey commissions third-party testing and assessment against the OWASP Application Security Verification Standard and the NIST technical guide for security testing.

XSS leak protection

Cross-site scripting is treated as the default threat model. Session material lives in HttpOnly cookies, so credentials can never be read back out of the page.

CSRF protection

Cross-site request forgery is closed off by cookie configuration we maintain on your behalf, including a conservative SameSite policy on every session cookie.

Session fixation protection

The session token is reissued on every sign-in and sign-out. The previous token is invalidated the instant the replacement is minted, so a captured value dies with it.

Password rules & screening

Character rules follow current NIST guidance, prospective passwords are screened against the BreachIndex corpus, and storage uses bcrypt with a tuned work factor.

Session leak protection

Cookies are scoped per host rather than shared across subdomains, so a compromise on one surface can never be chained into an attack on the next.

Security, privacy, and compliance in one tool

SOC 2 Type II HIPAA CCPA

Session management

Cut authentication down to
sub-millisecond overhead

Havenkey manages the whole session lifecycle, including the parts most teams postpone — active device visibility and instant revocation.

  • Don't let auth slow your critical path. The session layer is built to stay low-latency in every region you serve. Skip the effort of running that infrastructure and let us obsess over it instead.

  • Stop takeovers in their tracks. Our team assesses emerging threats continuously so your team doesn't have to. Revocation is there from the first day rather than a third-quarter project.

  • Multi-account, multi-device by default. People keep work and personal contexts apart. Havenkey lets one person hold several signed-in accounts at once and switch between them cleanly.