Platform features

Powerful identity, access, and security.

Everything you need to manage authentication, authorization, and user identity — from startup to enterprise scale.

Single sign-on

Enterprise SSO, simplified.

Connect any identity provider in minutes. Support SAML, OIDC, Google, Microsoft, and LDAP out of the box with automatic protocol negotiation.

  • SAML 2.0 service provider
  • OIDC relying party
  • Google Workspace connector
  • Microsoft Entra ID connector
  • LDAP directory integration
  • Just-in-time provisioning
admin.calimatic.com / sso
Identity providers+ Add provider
GGoogle WorkspaceOIDC · 1,204 usersActive
MMicrosoft 365Entra ID · SCIM onActive
OKOktaSAML 2.0 · JITActive
LDCorporate LDAPSynced 4 min agoActive
Multi-tenancy

Every tenant, isolated by design.

First-class multi-tenancy with isolated organizations, custom plans, domain routing, and per-org settings — all managed from a single admin console.

  • Organization types and plans
  • Custom domain routing
  • Per-org feature limits
  • Org-scoped user management
  • Hierarchical org structures
  • Bulk org provisioning
Organizations
All organizations+ New org
ARAcme Roboticsacme.yourapp.com · 1,384 membersOwner
NLNorthlake Schoolssso.northlake.edu · 12,051 membersAdmin
VGVega Labsvegalabs.io · 96 membersMember
Access control

Roles that mirror your org chart.

Define granular permissions with custom roles, role hierarchy, and organization-scoped assignments. Control access at every level of your application.

  • Custom role definitions
  • Permission-based access checks
  • Role hierarchy and inheritance
  • Org-scoped role assignments
  • Built-in admin/user/viewer roles
  • API-level permission enforcement
Roles & permissions
Custom roles+ New role
</>AdminFull platform access4 members
</>Billing Managerbilling:*, invoices:read2 members
</>Support Agentusers:read, tickets:*14 members
</>Auditoraudit-log:read3 members
Application licensing

Three layers of app access control.

A three-layer licensing model that separates app registration, organization enablement, and individual user access for maximum flexibility.

  • App client registration
  • Org-level app enablement
  • Per-user license assignment
  • Auto-assignment on invite
  • License usage analytics
  • Seat-based limits
Application licensing
Layer 1App client3 registered apps3/10
Layer 2Org enablementEnabled per organization7 orgs
Layer 3User licenseAuto-assigned on invite1,204/5,000
Login branding

White-label every login flow.

Customize the login experience for every organization and application. White-label your auth flows with custom logos, colors, and messaging.

  • Per-org custom branding
  • Per-app login themes
  • Custom logo and colors
  • Custom login messages
Login theme editor
Logo
Acme
Primary
Sign in to Acme
Audit logging

Immutable evidence, on demand.

Immutable, comprehensive audit logs for every security-relevant action. Meet compliance requirements with configurable retention and export options.

  • Immutable event log
  • Login/logout tracking
  • Admin action recording
  • Configurable retention
  • CSV/JSON export
  • Real-time log streaming
Audit log · admin.calimatic.com
14:32:07grace@acme.cosso.loginprovider=google · ip=203.0.113.42
14:31:52systemscim.sync.completedorg=acme · added=3 · updated=12
14:29:14admin@acme.couser.role.updatedtarget=liu@acme.co · role=billing-mgr
14:28:03kai@vega.ioapi-key.createdscope=orgs:read,users:read
14:26:55systemwebhook.deliveredevent=user.invited · 200 · 84ms
OAuth2 / OIDC server

Standards, not surprises.

A full-featured OAuth 2.0 and OpenID Connect authorization server with PKCE, token introspection, and dynamic client registration.

  • Authorization code + PKCE
  • Client credentials flow
  • Token introspection endpoint
  • JWKS and discovery endpoints
  • Dynamic client registration
  • Refresh token rotation
POST /oauth/token
# Authorization Code + PKCE
grant_type=authorization_code
code=k9n4-p2xr-b5tf
redirect_uri=https://app.acme.co/callback
code_verifier=e2vX…d17q
client_id=acme_web_prod

# → 200 OK
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "id_token": "eyJhbGciOiJSUzI1NiIs…",
  "refresh_token": "rt_9m2n…q4p8"
}
API keys

Machine access, properly scoped.

Issue scoped API keys with fine-grained permissions and expiration policies. Perfect for service-to-service and CI/CD integrations.

  • Scoped API keys
  • Expiration policies
  • Permission-based scoping
  • Key rotation support
API keys
Active keys+ New key
PRacme_prod_writescope: users:*, orgs:read · expires 90dActive
CIci_pipelinescope: audit:read · expires neverActive
MGmigration_2026scope: users:write · expires 7dActive
Database integration

Sync users from any directory.

Sync user directories from external databases. Connect to SQL Server, PostgreSQL, and MySQL with scheduled or real-time sync.

  • SQL Server sync
  • PostgreSQL sync
  • MySQL sync
  • Scheduled sync jobs
  • Custom field mapping
  • Conflict resolution
Data source sync
PGPostgreSQL · Acme HRNightly · 12,041 rows syncedSynced
MSSQL Server · Legacy CRMEvery 15 min · realtimeSynced
MYMySQL · NorthlakeEvery hour · JIT provisioningSynced
User provisioning

One API for every user lifecycle event.

A unified API for creating, importing, and managing users across all your applications. Supports single provisioning, bulk import, and SCIM 2.0 for enterprise integrations.

  • Single user provisioning
  • Bulk import (up to 500 users)
  • Email deduplication
  • SCIM 2.0 protocol support
  • Auto-licensing on provision
  • External ID mapping
POST /api/v1/users/bulk
[
  {
    "email": "kai@acme.co",
    "first_name": "Kai", "last_name": "Tanaka",
    "org_id": "org_acme", "role": "billing-mgr",
    "apps": ["finance", "reports"]
  }
]

# → 202 Accepted · 500 users queued · SCIM 2.0 compatible
Webhooks

Real-time changes, delivered.

Subscribe to user lifecycle events and sync changes to your applications in real time. HMAC-signed payloads with automatic retries and delivery logging.

  • User lifecycle events
  • HMAC-SHA256 signed payloads
  • Automatic retries with backoff
  • Delivery status logging
  • Per-org webhook scoping
  • Auto-disable on repeated failure
Webhook deliveries
user.createdhttps://app.acme.co/hooks/id84 ms200
user.role.updatedhttps://app.acme.co/hooks/id112 ms200
org.member.removedhttps://app.acme.co/hooks/id68 ms200
user.deactivatedhttps://reports.acme.co/hooks— msretry
Developer experience

Ship auth in an afternoon.

A platform built for developers. Complete REST API, comprehensive documentation, OIDC discovery, and integration guides for popular frameworks.

  • Full REST API
  • 4 getting-started guides
  • OIDC discovery endpoint
  • Next.js integration guide
  • React SDK examples
  • SCIM 2.0 support
app/api/auth/[...nextauth]/route.ts
import NextAuth from "next-auth"
import Calimatic from "next-auth/providers/calimatic"

export const { handlers, auth } = NextAuth(({)
  providers: [
    Calimatic({)
      clientId: process.env.CALIMATIC_ID!,
      clientSecret: process.env.CALIMATIC_SECRET!,
      issuer: "https://auth.calimatic.com",
    }),
  ]
})

// PKCE + refresh rotation handled automatically
Enterprise security

Enterprise-grade, top to bottom.

Enterprise-grade security at every layer. AES-256-GCM encryption, MFA support, password policies, account lockout, and session management.

  • AES-256-GCM secret encryption
  • Multi-factor authentication
  • Configurable password policies
  • Account lockout protection
  • Session management
  • Security headers enforcement
Security posture
Encryption at restAES-256-GCM
MFA enforcementRequired for admins
Password policy12 chars · rotation 90d
Session TTL8h · sliding refresh
Failed login lockout5 attempts · 15 min
Security headersHSTS · CSP · X-Frame-Options

Ready to explore these features?

Start building with Calimatic Identity today — free for up to 100 users.