Sign-in, SSO and roles for your app
Hosted OIDC login with SSO, MFA and CAPTCHA. Manage users, roles and organizations from the console, CLI or SDK.
Everything between the login screen and your API
Hosted login over OIDC
Your app sends users to a Blocks login page and gets tokens back through the Authorization Code flow with PKCE. You set token lifetimes, remember-me and lockout after failed attempts, and the page carries your branding in light and dark themes.
SSO with your identity provider
Connect Keycloak, Okta, Auth0, Azure AD or any provider with a JWKS URL or certificate, and map JWT claims to user fields.
MFA and CAPTCHA
Email codes or an authenticator app, with backup codes. Require MFA per role or per client, and put reCAPTCHA or hCaptcha on the login page.
Roles and permissions
Write permissions that guard API endpoints, hide UI actions or mask data, then group them into roles. Preview a change's impact before you save it.
Organizations
Serve many customer workspaces from one app. Users switch organization inside your app, and tokens can be scoped to one organization.
Access for services and devices
Client credentials give your backend services a token tied to a role. The OAuth device flow signs in CLIs and devices that can't show a login page.
From login button to permission check
The React web app that blocks new web generates already has the login button, the callback route and route guards. Any other app signs in through the same OIDC flow.
Choose a provider
OktaAzure ADKeycloakAuth0Enter the MFA code
Attach roles
support-agentbilling-viewerIssue the token
{ "sub": "usr_8a2f", "roles": ["support-agent", "billing-viewer"] }
Register an OIDC client
Create a client for your app's domain in the console or with
blocks auth oidc-clients. The scaffold looks it up for you.Send users to hosted login
Your app redirects to the Blocks login page, and the
/login/callbackroute turns the result into a session that refreshes itself.Check roles and permissions
Read the signed-in user's roles to show or hide features. The gateway enforces endpoint permissions and answers 403 when one is missing.
# OIDC clients your apps sign in with
blocks auth oidc-clients list --json
# Tenant MFA policy and login CAPTCHA
blocks mfa config get --json
blocks captcha list --json
# Deactivate a user, dry run first
blocks iam users deactivate usr_8a2f --dry-runIdentity providers
- Keycloak
- Okta
- Auth0
- Azure AD
- Microsoft
- GitHub
- Any provider with a JWKS URL
Recent changes to IAM
All IAM updates- Jul 30, 20262026.07.30Blocks OS Platform
- Jun 29, 20262026.06.29Workflow Versioning, MFA & Guided Environment Migration
- Apr 29, 2026v3.7.15Workflow Data Integration, Localization Control & Identity EnhancementsData trigger and action nodes for workflows, localization glossary, configurable sign-up flows, and Blazor scaffolding in the CLI.
Questions about IAM
Which identity providers can my users sign in with?
Keycloak, Okta, Auth0 and Azure AD connect directly, and any other provider can connect through a JWKS URL or an uploaded certificate. Social sign-in with Google, Microsoft, GitHub and others is available too.
Which MFA methods are there?
Email one-time codes and authenticator apps (TOTP), with backup codes. You can require MFA for every user, for some roles, or for one OIDC client.
Can my backend call Blocks without a user?
Yes. Create client credentials and assign them a role, and your service gets tokens with that role's permissions. Tokens can also be scoped to one organization.
Do I have to build the login screens?
No. Users sign in on the Blocks hosted login page, which shows your branding in light and dark themes. Your app handles the redirect and the /login/callback route, and the blocks new web scaffold includes both.
Often used with
Start with a free project
Sign up at os.seliseblocks.com and create a project, or paste one prompt into Claude Code, Codex or Cursor and let your agent set it up through the Blocks CLI.