elvix
npm install @elvix.is/sdk

Ship sign-in
this afternoon.

Passwordless auth for React and Next.js: passkeys, email codes, Google, and GitHub with one provider and one component. Identity, kept in Europe.

Start building See the components
passkeysemail codesgooglegithubeu-hosted
A
Sign in to Acme
Pick how you want to continue.
Continue with Google
or
By continuing, you agree to Acme's
Terms of Service·Privacy Policy
Secured by elvix
v0.10.1
your console, in miniature

in production this updates running apps in seconds

Auth methods
Passkeys, email codes, Google, GitHub
Frontend
React and Next.js components
Residency
Hosted in the EU, under EU law
Rights
See, export, delete: self-serve
The SDK is the product

Skip the settings-page work entirely.

Sign-in is the front door. Behind it live the screens every team dreads building: session management, passkey enrollment, GDPR requests. Yours ship on day one, and every piece looks finished because it is.

<ElvixSessions />The screen every team rebuilds. Yours ships with it.

Revocation, device labels, last-seen. Zero tables built by you. (demo data)

<ElvixAppPasskeys />WebAuthn, enrollment, recovery: handled.
Passkeys for Acme

Phishing-proof. These passkeys can only sign you in to Acme. Account-level passkeys you added on /account/security work here too and are managed there.

Your users go passwordless without you reading a single WebAuthn spec page. (demo data)

<ElvixExport />GDPR requests answered by UI, not by you.
What you'll receive

Your archive will contain a single JSON file with everything below, plus your avatar and banner images if you've uploaded any, plus a README that explains each section in plain language and includes the GDPR Art. 15(1) disclosures.

Loading

Not included: cryptographic key material on your passkeys, OAuth tokens, OTP codes, and any data the apps you use hold about you outside elvix. Contact each app for the latter.

The compliance email you never have to answer again. (demo data)

Also in the box:Avatars and bannersSecured badgeAddressesLegal entitiesLanguagesPresenceBuilt in, not bolted on.
Explore all components
Identity, kept in Europe

When procurement asks where the data lives, you answer in one word and move on.

Sign-in, profiles, and sessions live on infrastructure in the European Union, governed by EU law and the GDPR. Not an American cloud, not an adequacy debate.

  • Hosted in the EU, on European infrastructure
  • Governed by EU law and the GDPR
  • GDPR rights are buttons, not tickets
residency recordEU
data at restEuropean Union
governing lawEU law, GDPR
US cloud in the loopnone
see / export / deleteself-serve, on the account page
answer for procurementone word
For developers

Two imports. Every method. No password table.

Drop the provider at the root and the form where sign-in lives. Methods, branding, and legal links come from your Console config. Change them there and running apps update in seconds, no redeploy.

app/sign-in/page.tsx
import { ElvixProvider, ElvixSignInForm } from "@elvix.is/sdk/react";

export default function SignIn() {
  return (
    <ElvixProvider clientId="elvix_pub_...">
      <ElvixSignInForm />
    </ElvixProvider>
  );
}
No password column in your database
Passwords never exist. Passkeys and one-time codes mean there is nothing to hash, rotate, or leak.
Real-time by design
Roles, permissions, and bans reach running apps over SSE in seconds. Presence is built in.
A Console that does the admin work
Apps, users, roles, API keys, webhooks, logs, and insights. Your product keeps its own database clean.
14:09:31passkey verified·session mintedeu

Your coding agent already knows elvix.

Point it at mcp.elvix.is. The docs are written for agents as much as for humans, and every component page ships a prompt your agent can run. Building by hand? The same docs read just as well for you.

agent · GET /docs/components/elvix-sign-in-form.md · 200
About the MCP server
The full developer pitch
For the people signing in

It is your identity. You control it.

If you got here by clicking a Secured by elvix badge, this is the system behind that screen. Every right the GDPR gives you is a button on the account page, not an email to a support desk.

  • See it: everything elvix holds about you, in plain language
  • Export it: the full record as a file, GDPR Article 15, one click
  • Delete it: leave an app or erase the identity, no ticket
Go to your account
identity passport
yousole holder, all elvix apps
SEE ✓
the full record, plain language
EXPORT ✓
one click, GDPR Art. 15
REVOKE ✓
any session, any device
DELETE ✓
any time, no ticket
Everything above is a button, not a support ticket.

Auth was never your product.
Ship it this afternoon and move on.

Create an app in the Console, drop in the provider and the form, and your users are signing in with passkeys before the day ends.

Start building Read the docs
no passwords were created in the making of this page