Govern · Authentication

Authentication, built in

OAuth with GitHub and Google, email/password authentication, session management, and fine-grained permissions. Security infrastructure you don't have to build.

Get Started

What Authentication gives you

OAuth Providers

Email/Password

Traditional authentication for users who prefer it.

Session Management

Sessions expire after three days on their own. Revoke one device or all of them at any time.

Permission System

Fine-grained permissions beyond just roles. Grant or deny specific actions.

Account Security

PBKDF2 password hashing with a per-password salt and timing-safe comparison.

Why Authentication matters

Don't build your own auth. The infrastructure is already built and tested.
OAuth + email gives users choice
Fine-grained permissions for complex access requirements

How Authentication works

Authentication in Runwork gives you the identity management you would otherwise build from scratch. OAuth with GitHub and Google, traditional email/password, session management, and fine-grained permissions. All the security infrastructure your apps need is built in and ready to use.

User authentication flows are pre-built. Add "sign in with Google" or "sign in with GitHub" to your apps without configuring OAuth providers yourself. Traditional email/password authentication is also available for users who prefer it. Sessions expire automatically after three days and can be revoked individually or all at once.

The permission system goes beyond simple roles. Grant or deny specific permissions per user or per group across workspace settings, members and groups, apps, integrations, API keys, public endpoints, and logs. Denies beat grants at the same level, and a user-level override beats a group-level one in either direction, so a user grant opens something a group deny closed.

Passwords are hashed with PBKDF2 and a per-password salt, and password comparison is timing-safe.

Frequently Asked Questions

What authentication methods does Runwork support?

Runwork supports OAuth with GitHub and Google for social login, plus traditional email/password authentication. Sessions expire automatically after three days and can be revoked individually or all at once. You can offer users multiple authentication options without building any auth infrastructure yourself.

How does the permission system work?

Permissions are fine-grained. Beyond basic roles, you can grant or deny specific permissions per user or per group across workspace settings, members, groups, apps, integrations, API keys, public endpoints, and logs. Denies beat grants at the same level, and user-level overrides beat group-level ones in either direction. So a user grant opens something a group deny closed, and a user deny is final.

Is account security built in?

Passwords are hashed with PBKDF2 using a per-password salt, and password comparison is timing-safe. Sessions expire after three days and can be revoked individually or all at once.

Can I build multi-tenant apps with different user bases?

Yes. Workspaces provide isolation between tenants, each with their own users and permissions. Within a workspace, teams organize users into groups with shared access levels. This enables complex multi-tenant architectures without custom auth logic.

Use Cases

User sign-up flows Team access control Multi-tenant apps Secure admin panels

Related Features

Permissions Workspaces Compliance

See How Teams Use Authentication

Client Portals SaaS Teams Healthcare Teams

Ready to try Authentication?

One shared cloud under the AI tools your team already uses.

Get Started Explore More Features