Your users sign in, your app reads who they are from a header — and you wrote no authentication code.
Authentication is where most projects stall. nesly offers three ways out, each one command: close a site to everyone but your team, let your visitors sign in with Google, Microsoft, GitHub or any OpenID Connect provider at the edge, or give your application its own OpenID Connect client on the platform identity provider.
How it works
- 1
Choose who may enter
nesly auth protectcloses the project's addresses to everyone but your team.nesly auth allowadmits a person or a whole domain (@client.com). - 2
Or bring your own provider
nesly auth provider setwith your Google, Microsoft, GitHub or OIDC app. The command prints the one redirect URI to register; the sign-in happens at the edge, before your app sees the request. - 3
Read the user, skip the library
Every request that passes carries
X-Nesly-User-Id,X-Nesly-User-EmailandX-Nesly-User-Name. Your code reads headers; it never handles tokens, cookies or callbacks.
What you get
Protection before the first byte
The gate is at the edge: an unauthenticated request never reaches your application, so a half-finished admin page is not exposed by accident.
Your provider, your users
Google, Microsoft, GitHub or any OpenID Connect issuer. The platform handles the redirect, the code exchange and the session; you see a verified identity.
An OpenID Connect client of your own
nesly addon add oidc creates a client on the platform identity provider and injects OIDC_ISSUER_URL, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET for apps that want to run the flow themselves.
Previews behind a password
nesly protect preview set puts a shared password on the project's preview addresses while production stays public, so a client reviews the next release without the world seeing it; a token lets your CI through.
Reversible in one command
nesly auth clear removes the gate; nesly auth provider clear goes back to platform sign-in. nesly auth status tells you what is on and who may pass.
Pricing
Sign-in protection, your own provider, preview passwords and the OpenID Connect add-on are included in every plan; there is no per-user fee.
- Nothing to buy and nothing to run: the identity provider behind the add-on is the platform's own.
Use cases
An internal tool for the team
nesly auth protect and the tool is reachable only by people on your account; the app itself has no login page.
A client portal
Visitors sign in with their company Microsoft account; your app reads the e-mail header and shows that client's data.
A product that needs accounts
Attach the OpenID Connect add-on and use the standard library of your framework against OIDC_ISSUER_URL; no identity server to run.
Questions, answered
- Does my application need an auth library?
- For the edge gate and your own provider, no: you read three headers. For the OpenID Connect add-on, you use your framework's standard OIDC client against the injected issuer.
- Can visitors outside my team sign in?
- Yes.
nesly auth allowadmits individual addresses or whole domains behind the platform gate, andauth provider setlets anyone with an account at your provider sign in. - Can I trust the headers?
- They are set by the platform after a verified sign-in and overwrite anything a client sends; a request without a valid session never reaches your app while the gate is on.
- Which providers are supported?
- Google, Microsoft, GitHub, and any OpenID Connect issuer by its issuer URL, client id and secret.
Related products
Applications
Push your code; it is live in minutes. Every change gets its own address, and one command puts the last release back.
.NET and SQL Server
ASP.NET Core deployed as it is, with a SQL Server database your app reads through GetConnectionString("Default").
Domains and DNS
Bring a domain or buy one from the CLI, point it at us or let us run its DNS, and HTTPS is issued and renewed for you.
Put a sign-in in front of a project
nesly auth protect takes one second and no code. Open it to clients with nesly auth allow.