Authentication,
made better for Tanzania.
Sign-up, sign-in, social login and two-factor for your website, mobile app and API. Ready in an afternoon, secure from day one.
npm install @tausi-auth/js- Seven social providers
- Two-factor authentication
- Bot protection built in
import { tausi } from "@/lib/tausi";
export default async function Dashboard() {
// Redirects to /sign-in when nobody is signed in
const { user } = await tausi.requireAuth({ returnTo: "/dashboard" });
return <h1>Karibu, {user.firstName ?? user.name}!</h1>;
}Spend your time on your product, not on login screens
Authentication is easy to start and hard to get right. Tausi gives you the finished, secure version from day one.
Ship sign-in in an afternoon
Install one package, paste two keys, and your app has sign-up, sign-in, password reset and social login.
Security without the homework
Argon2id passwords, hashed tokens, PKCE, rate limits and breached-password checks are on by default.
Fewer fake accounts
CAPTCHA, sign-up limits per network and device, and IP blocklists stop bots before they cost you money.
One account, every platform
Your website, mobile app and API share the same users. Sign up on the web, sign in on Flutter.
Everything between “Sign up” and “Signed in”
The flows your users see, the tools your team needs, and the protection your business depends on.
Every way to sign in
Email and password with verification, plus the social providers your users already have.
- Google, Apple, Facebook, GitHub, Microsoft, X and LinkedIn
- Email verification and password reset links
- PKCE on every social sign-in
Two-factor authentication
Users protect their accounts with an authenticator app.
- Google Authenticator, 1Password, Authy…
- Backup codes for lost phones
- Reset from the dashboard or your backend
Sessions and devices
Users see where they're signed in and can sign out anywhere.
- Sessions checked on every request
- A ban or sign-out takes effect at once
- Session length set per project
User management
Search, edit and moderate users from the dashboard or your backend.
- Ban, suspend for a set time, or delete
- Bulk actions on up to 100 users
- Username, phone (+255…), locale and metadata
Abuse protection
Stop bots and repeat sign-ups without annoying real people.
- Cloudflare Turnstile or hCaptcha
- Limit accounts per IP and per device
- Block known-breached passwords
API keys built for production
Separate keys for browsers and servers, with the controls security reviews ask for.
- Read-only secret keys
- Allowed IP addresses per key
- Alerts when a key is used from a new IP
Logs and insights
See sign-ups, sign-ins and security events for each project.
- Audit log of every change
- Sign-up and activity charts
- Suspicious activity flagged
One project per app
Every app gets its own isolated users and settings.
- Users in a separate database schema per project
- Allowed origins and redirect URLs
- Password and email rules per project
Emails handled
Verification, password reset and account notices go out under your app's name.
- Links that open in your app
- Security notices to users
- No email templates to build
Three steps to signed-in users
Your app talks to Tausi with a public key. Your server checks sessions with a secret one.
- 01
Create a project
Sign up, create a project for your app, and choose its sign-in methods and rules.
pk_…sk_… - 02
Add the SDK
Install the package for your stack and use the ready-made hooks or your own screens.
npm install @tausi-auth/js - 03
Protect your API
Your backend checks each request with the secret key. Banned or signed-out users are refused at once.
requireAuth(tausi)
Official SDKs for the stack you already use
Typed, tested and documented, with the same users, errors and sessions everywhere.
Web: Next.js, React, Vue, Svelte
npmHooks, components and an HttpOnly-cookie mode where the browser never holds the token.
npm install @tausi-auth/js@tausi-auth/js Node.js and Express
npmProtect your API in one line and manage users.
npm install @tausi-auth/node@tausi-auth/node Python: Django, Flask, FastAPI
PyPIDecorators and middleware for Django, DRF and Flask.
pip install "tausi[django]"tausi PHP and Laravel
PackagistMiddleware for Laravel and plain PHP, plus server-rendered sign-in.
composer require tausi/tausi-phptausi/tausi-php Flutter
Coming soonAndroid, iOS, web and desktop, with sessions in secure storage.
# tausi_fluttertausi_flutter AI coding tools (MCP)
npmClaude Code, Codex, Cursor and others set Tausi up for you.
npx -y @tausi-auth/mcp --help@tausi-auth/mcp Your users' accounts, protected properly
A breach of your login system is a breach of everything behind it. Tausi applies the practices security teams expect.
- Passwords hashed with Argon2idThe algorithm OWASP recommends, with memory-hard settings that make stolen hashes expensive to crack.
- Tokens and keys stored as hashesA database leak doesn't hand anyone a working login.
- Isolated user basesEach project's users live in their own database schema.
- HttpOnly cookies on your domainIn cookie mode the session never touches JavaScript.
- PKCE and allowed redirect URLsSocial sign-in only returns to addresses you approved.
- Rate limits everywhereSign-in, sign-up, password reset and every secret key are rate-limited.
What you skip by not building auth yourself
Every row is something your team would otherwise design, build, test and keep secure.
| What you need | Build it yourself | With Tausi |
|---|---|---|
| Time to working sign-in | Weeks of design, building and testing | An afternoon |
| Password storage, reset, email verification | You build and maintain them | Included |
| Social sign-in with seven providers | One integration at a time | Turn on in the dashboard |
| Two-factor authentication | Weeks of extra work | Built in |
| Bot and fake sign-up protection | Usually added after the first attack | Built in |
| Web, mobile and backend SDKs | Write and keep each client in sync | Official SDKs for every stack |
Ask your coding assistant to add sign-in
The Tausi MCP server connects Claude Code, Codex, Cursor, VS Code, Windsurf and Gemini CLI to your project.
- Installs the right package with your package manager
- Writes the setup code for your framework
- Answers questions about your users, with a read-only key
Questions developers ask
Do I need my own backend?
No. A single-page app or a mobile app can sign users in with just the publishable key. When you add an API, verify each request with the secret key using the Node.js, Python or PHP SDK.
Can my website and mobile app share users?
Yes. Put them in the same project: a user who signs up on the web signs in on Flutter with the same account.
Do you support two-factor authentication?
Yes. Users turn it on with any authenticator app and get backup codes; sign-in then asks for a code after the password. You can turn it off for a user who lost their phone.
Do Tanzanian phone numbers work?
Yes. Users can save a phone number in international format, such as +255 712 345 678, along with their language and time zone (for example sw-TZ and Africa/Dar_es_Salaam).
Where are passwords kept?
In Tausi's database, hashed with Argon2id. Your app never sees or stores them.
How do I stop fake sign-ups?
Turn on CAPTCHA (Cloudflare Turnstile or hCaptcha), cap accounts per IP or device, block IP ranges, and refuse breached passwords, all per project.
Can AI coding tools set it up?
Yes. Connect the Tausi MCP server to Claude Code, Codex, Cursor or VS Code and ask it to add sign-in.
Give your users a sign-in they can trust.
Create a project, add the SDK, and ship secure authentication today.