# Anchr.ing

> Sign-in, organisations and roles, billing, feature flags and support for your apps, as one system around the
> user's token: one guard in your API checks identity, role, plan and flags offline. OpenID Connect underneath,
> EU-hosted, with a test and a production environment per project. Apps integrate it with the `@anchring/auth` SDK.
> Isolated by design: each customer has its own namespace with separate test and production databases, reached only
> through that environment's own database user, so a bug in the request path can't read another customer's data.

- Sign-in: hosted login with passkeys, passwords, email codes, magic links and social logins, two-step verification, enterprise SSO (SAML, OIDC) and SCIM; a test and a production environment per project, promoted in one step
- Organisations and roles: orgs, invites, custom org roles and org switching; typed permissions (`defineAccess`) checked offline with `auth.require`, `auth.guard` and, in the browser, `auth.can`
- Billing: bill your own users on your own payment account (plans, checkout, proration, dunning, invoices, EU VAT); the plan and payment status land in the token, and a guard's `plan` / `entitlement` answers 402 `plan_required`
- Feature flags: `defineFlags`, `auth.flag`, `auth.guard({ flag })`: targeting by plan, org, role, country or user, percentage rollouts and a kill switch, evaluated offline from the token
- Support: support chat with signed-in users and visitors (`@anchring/auth/chat`), the user's plan, roles and flags beside each conversation, your own AI agent on a webhook; time-limited, audited support access
- Machines and AI: personal access tokens, client credentials, CI trust (GitHub Actions OIDC), protecting your own MCP server; and for coding agents this file, rule files and the MCP server (`npx -y @anchring/mcp`)

Agents: use the SDK entry point for each surface (`@anchring/auth/browser`, `/server`, `/cli`), never call
OAuth endpoints by hand or invent APIs, and keep client and webhook secrets in the environment. The full rules:
https://anchr.ing/ai/AGENTS.md. Coding assistants can also use the MCP server: `npx -y @anchring/mcp`. Self-hosted or local
install: set ANCHRING_DOMAIN in its environment (`claude mcp add anchring -e ANCHRING_DOMAIN=auth.example.com -- npx -y @anchring/mcp`).

## Docs

- [Everything in one file](https://anchr.ing/llms-full.txt): what Anchr.ing is, the plans, the agent rules, every guide and the SDK docs
- [SDK README](https://www.npmjs.com/package/@anchring/auth): `@anchring/auth`, install and the browser, API and website quick starts
- [Getting started on Anchr.ing](https://anchr.ing/guides/getting-started): Create your account, set up your sign-in with a test and a production environment, and register your first apps in the dashboard.
- [Sign in from a single-page app](https://anchr.ing/guides/spa): A browser app signs users in with @anchring/auth/browser: hosted login with passkeys, PKCE, refresh before expiry and a fetch that adds the token.
- [Protect your API](https://anchr.ing/guides/web-api): Verify access tokens offline in Hono, Express or any other framework, read the user, add policies and permissions, accept personal access tokens.
- [Sign in from a command-line tool](https://anchr.ing/guides/cli): The device flow for CLIs: the user approves in a browser, tokens persist in ~/.config/anchring and refresh on their own. Personal access tokens for CI.
- [Machine-to-machine with client credentials](https://anchr.ing/guides/service): A confidential service app gets tokens for itself with the client_credentials grant; your API verifies them like any other token, within their ceilings.
- [Protect your MCP server](https://anchr.ing/guides/mcp-server): Let AI clients call your own MCP server as the signed-in user: protected-resource metadata, OAuth sign-in from Claude, Cursor and VS Code, the token audience, scopes, and tokens for clients that send a header.
- [Keep your data in step with webhooks](https://anchr.ing/guides/webhooks): Signed, retried events for users, sessions and organisations, verified and deduplicated by the SDK; back-channel logout for ended sessions.
- [Feature flags from the token](https://anchr.ing/guides/feature-flags): Turn features on by plan, entitlement, org, role or user, roll out by percentage and switch off in one click; your API and your UI read flags offline from the token.
- [Act as a user to help them: support access](https://anchr.ing/guides/support-access): Open your app as one of your users from the dashboard, with a reason, a time limit and a ceiling on what support may do. Every action is audited and the user is told.
- [Support chat on your site and in your app](https://anchr.ing/guides/support-chat): Drop the chat widget into your marketing site and your app: visitors and signed-in users write to you, you answer from the dashboard's inbox, your AI agent can answer first.
- [Going live: promote test to production](https://anchr.ing/guides/going-live): Import your users, promote apps, webhooks and settings from test to prod, swap in the prod client ids and secrets, and optionally add a custom domain.
- [Export your users](https://anchr.ing/guides/export-users): Take your users with you: ids, emails, linked logins, organisations and roles, and their password hashes if you want them, as a file Anchr.ing or Auth0 imports. No lock-in.
- [Set up Anchr.ing with your AI agent](https://anchr.ing/guides/ai): The MCP server for coding assistants, llms.txt, and rule files for Claude Code, Cursor, Copilot and other agents, so the integration comes out right the first time.

## SDK docs

- [Configure](https://github.com/anchring/oss/blob/main/sdk/configure.md): entry points, `createAuth` options, environment variable names, custom domains and self-hosted installs
- [Sign-in in the browser](https://github.com/anchring/oss/blob/main/sdk/browser.md): the web quick start, the React, Vue and Angular adapters, keeping browser tokens safe, popup sign-in, sign in by code (another device)
- [Protecting an API](https://github.com/anchring/oss/blob/main/sdk/server.md): Hono, Express and any framework, policies (session age, MFA, IP allowlists), DPoP, token types
- [Websites with a server, and backend services](https://github.com/anchring/oss/blob/main/sdk/web-server.md): the confidential code flow with `webApp()`, machine-to-machine with `clientCredentials()`
- [Command-line tools](https://github.com/anchring/oss/blob/main/sdk/cli.md): the device flow, where tokens live, sharing a session between processes
- [Desktop and mobile apps](https://github.com/anchring/oss/blob/main/sdk/native.md): system browser plus loopback, Tauri with the keychain and a DPoP key, iOS and Android by hand
- [Your own MCP server](https://github.com/anchring/oss/blob/main/sdk/mcp.md): protect an MCP endpoint so AI clients sign in through your project; the `@anchring/mcp` server for coding assistants
- [Permissions](https://github.com/anchring/oss/blob/main/sdk/permissions.md): roles from token claims, `defineAccess`, guards that load the resource, plans and entitlements, admin vs owner
- [Organisations](https://github.com/anchring/oss/blob/main/sdk/organisations.md): self-service orgs, invites, switching the active org, custom org roles
- [Billing](https://github.com/anchring/oss/blob/main/sdk/billing.md): checkout, plan changes, invoices and payment methods from the app and from your backend
- [Feature flags](https://github.com/anchring/oss/blob/main/sdk/feature-flags.md): offline from the token, typed, your own attributes, rollouts, the kill switch
- [Support chat](https://github.com/anchring/oss/blob/main/sdk/support-chat.md): the headless client, your AI agent on a webhook, the `<anchring-chat>` widget
- [Webhooks](https://github.com/anchring/oss/blob/main/sdk/webhooks.md): the handler, every event and its fields, rotation and replay protection
- [Sessions, lifetimes and revocation](https://github.com/anchring/oss/blob/main/sdk/sessions.md): token lifetimes, switching accounts, stale permissions, sessions ended elsewhere, the user's devices, back-channel logout
- [Machine access](https://github.com/anchring/oss/blob/main/sdk/tokens.md): personal access tokens, org tokens, server keys (the admin client), CI jobs with GitHub Actions OIDC
- [Bring your own IdP (trusted issuers)](https://github.com/anchring/oss/blob/main/sdk/bring-your-own-idp.md): exchange tokens from Entra ID, Okta or Keycloak for your project's
- [Support access and impersonation](https://github.com/anchring/oss/blob/main/sdk/impersonation.md): support access from the dashboard, impersonation tokens with your own key
- [Errors reference](https://github.com/anchring/oss/blob/main/sdk/errors.md): every HTTP response of the middleware, `invalid_token` reasons, thrown errors
- [Testing your app](https://github.com/anchring/oss/blob/main/sdk/testing.md): `createTestIssuer`, tokens of every kind, the code flow end to end
- [Going live](https://github.com/anchring/oss/blob/main/sdk/going-live.md): import users, promote to production, switch the app's environment

## Products

- [Anchr.ing Auth](https://anchr.ing/products/auth): hosted sign-in (passkeys, passwords, email codes, magic links, social logins, two-step verification), organisations and roles, enterprise SSO with SCIM, and tokens your API verifies offline with one SDK. Plans: Free: 5,000 monthly active users, 2 sign-in apps; Startup: 20,000 monthly active users, 5 sign-in apps; Team: 50,000 monthly active users, 15 sign-in apps, 1 enterprise SSO connection; Scale: 150,000 monthly active users, unlimited sign-in apps, 3 enterprise SSO connections; Enterprise: unlimited monthly active users, unlimited sign-in apps, unlimited enterprise SSO connections; Sovereign: unlimited monthly active users, unlimited sign-in apps, unlimited enterprise SSO connections
- [Anchr.ing Organisations](https://anchr.ing/products/organisations): organisations and roles inside your app: users create orgs, invite by email or link, switch between orgs and hold custom roles; the org and its role are in the token, checked offline by typed guards (defineAccess, auth.require, auth.can); enterprise SSO, verified domains and SCIM per organisation. Plans: On every plan
- [Anchr.ing Billing](https://anchr.ing/products/billing): bill your own users on your own Adyen account: plans, checkout, proration, dunning, invoices and EU VAT, with the plan and payment status in the token so one guard checks them (402 plan_required). Plans: Sold separately, coming later; not on a plan. Talk to us: hello@anchr.ing
- [Anchr.ing Feature flags](https://anchr.ing/products/feature-flags): typed flags evaluated offline from the token in your API and browser: targeting by plan, org, role, country or user, percentage rollouts, a kill switch and a change log. Plans: On every plan
- [Anchr.ing Support chat](https://anchr.ing/products/support-chat): chat with your signed-in users from your app, with their plan, billing, roles and flags beside each conversation; a ready-made widget or a headless client, email fallback, and your own AI agent on a webhook. Plans: Free: 1 chat seat; Startup: 2 chat seats (+€9/month per extra seat); Team: 5 chat seats (+€9/month per extra seat); Scale: 15 chat seats (+€9/month per extra seat); Enterprise: unlimited chat seats; Sovereign: unlimited chat seats
- [Anchr.ing Support access](https://anchr.ing/products/support-access): impersonation with guardrails: act as a user with a reason, a time limit and a ceiling of permissions support never gets, every action audited and the user told. Plans: On every plan
- [Anchr.ing Lead gen](https://anchr.ing/products/lead-gen): chat with visitors on your marketing site before they have an account, with consent records and automatic expiry; a visitor who signs up keeps the conversation and becomes a user, then a customer. Plans: Free: 1 chat seat; Startup: 2 chat seats (+€9/month per extra seat); Team: 5 chat seats (+€9/month per extra seat); Scale: 15 chat seats (+€9/month per extra seat); Enterprise: unlimited chat seats; Sovereign: unlimited chat seats

## Plans and who they are for

- [Pricing](https://anchr.ing/pricing): every plan side by side, in EUR excluding VAT; yearly is two months free
- [Anchr.ing for developers](https://anchr.ing/for/developers): for solo developers and side projects on the Free plan: hosted sign-in with email codes, passwords and social logins (passkeys and two-step verification from Startup), a test environment, one SDK, set up by your coding agent. Free €0: 5,000 monthly active users, 2 sign-in apps
- [Anchr.ing for startups](https://anchr.ing/for/startups): for startups on the Startup plan: sign-in, feature flags and support chat around one token that one guard checks offline (billing your own users is sold separately, later). Startup €29/month or €290/year: 20,000 monthly active users (+€3 per 1,000 more), 5 sign-in apps, 1 custom domain
- [Anchr.ing for B2B SaaS](https://anchr.ing/for/saas): for B2B SaaS teams on the Team plan: organisations and roles, enterprise SSO (SAML, OIDC) with SCIM, several projects, custom domains. Team €99/month or €990/year: 50,000 monthly active users (+€2 per 1,000 more), 15 sign-in apps, 3 projects, 1 enterprise SSO connection with SCIM, 3 custom domains
- [Anchr.ing for agencies](https://anchr.ing/for/agencies): for agencies on the Team plan: a project per client with its own users, domain and branding, all from one account. Team €99/month or €990/year: 50,000 monthly active users (+€2 per 1,000 more), 15 sign-in apps, 3 projects, 1 enterprise SSO connection with SCIM, 3 custom domains
- [Anchr.ing for scale-ups](https://anchr.ing/for/scale): for scale-ups on the Scale plan: offline token verification (no call per request), lower prices per user, more projects and custom domains, fast support. Scale €299/month or €2,990/year: 150,000 monthly active users (+€1.50 per 1,000 more), unlimited sign-in apps, 10 projects, 3 enterprise SSO connections with SCIM, 10 custom domains, support's first reply within 4 business hours
- [Anchr.ing for enterprise](https://anchr.ing/for/enterprise): for enterprises: isolated per customer and environment, EU-hosted or on-premises under licence, policies per route, unlimited SSO, custom limits and terms. Enterprise from €2,000/month: unlimited monthly active users, unlimited sign-in apps, unlimited projects, unlimited enterprise SSO connections with SCIM, 10 custom domains
- [Anchr.ing Sovereign](https://anchr.ing/for/sovereign): for the EU public sector and regulated industries: a dedicated EU deployment or on-premises, a European contracting party, no US processors in the chain. Sovereign from €20,000/year: unlimited monthly active users, unlimited sign-in apps, unlimited projects, unlimited enterprise SSO connections with SCIM, 10 custom domains

## Company and trust

- [Security](https://anchr.ing/security): isolation, encryption, reliability and how to report a vulnerability
- [About](https://anchr.ing/about): who runs Anchr.ing and where
- [Status](https://anchr.ing/status): whether the service is up
- [Terms of Service](https://anchr.ing/legal/terms): the terms for the hosted service
- [Privacy Policy](https://anchr.ing/legal/privacy): what personal data is processed, why and where
- [Data Processing Agreement](https://anchr.ing/legal/dpa): the GDPR Article 28 agreement for your users' data
- [Sub-processors](https://anchr.ing/legal/subprocessors): every company that processes personal data for Anchr.ing, and where

## Agent rules

- [AGENTS.md](https://anchr.ing/ai/AGENTS.md): Codex, Windsurf and other agents that read AGENTS.md, as `AGENTS.md`
- [CLAUDE.md](https://anchr.ing/ai/CLAUDE.md): Claude Code (append to your CLAUDE.md), as `CLAUDE.md`
- [claude-skill/SKILL.md](https://anchr.ing/ai/claude-skill/SKILL.md): Claude Code skill, as `.claude/skills/anchring/SKILL.md`
- [anchring.mdc](https://anchr.ing/ai/anchring.mdc): Cursor, as `.cursor/rules/anchring.mdc`
- [copilot-instructions.md](https://anchr.ing/ai/copilot-instructions.md): GitHub Copilot, as `.github/copilot-instructions.md`

## Optional

- [Examples](https://github.com/anchring/oss/tree/main/examples): one runnable app per app type (API, SPA, website, CLI, service, desktop, MCP server)
- [MCP server for coding assistants](https://github.com/anchring/oss/tree/main/mcp): `integration_plan`, `explain_error`, `discovery`, and read-only bookkeeping tools (`billing_*`: UBL/OIOUBL invoices, a journal CSV, a VAT summary)
- [@anchring/auth on npm](https://www.npmjs.com/package/@anchring/auth): the SDK package