Every visitor, identifiedZero auth code
Run your app in a Buddy Sandbox or behind a Buddy tunnel - Buddy signs in every visitor with workspace login or your company SSO. You choose who gets in, and one call tells you who's there.
Trusted by the world's leading engineering teams
How Identity works
Buddy sits in front of your app and signs visitors in before they reach your code. You run none of it - you just read the result.
- 01RequestA visitor opens your URL.
- 02Buddy sign-inWorkspace login or SSO.
- 03Check permissionsAllowed users and groups only.
- 04Identity deliveredYour app reads the user.
What Identity gives you
The difference is where auth lives: in the platform that hosts your app, not in your code.
Zero auth code.
No login form, no sessions, no callbacks - visitors are signed in before the request reaches you.
Protected by default.
One line of YAML closes the endpoint before its first deploy - staging never goes public by accident.
Full identity in one call.
getCurrentUser() returns the visitor's name, email, workspace role, groups, and SSO id - typed.
Access by users and groups.
Pick who can open each app - the users and groups you choose get in, everyone else is turned away.
SSO out of the box.
SAML 2.0 and OIDC - Okta, Microsoft Entra, Google, OneLogin - with mandatory sign-in when you need it.
Joiners in, leavers out.
Groups sync from your identity provider - new hires get access automatically, people who leave lose it everywhere at once.
Know your user in one call
Every sandbox and tunnel serves the visitor's identity at /.buddy/auth/me. The SDK is a small typed client for that endpoint - Node 18+, the browser, any framework.
Read the user in Next.js
Pass the request headers to getCurrentUser() in any Server Component or Route Handler - it returns the user, or null when signed out.
import { headers } from "next/headers";
import { getCurrentUser }
from "@buddy-works/identity";
export default async function Page() {
const user = await getCurrentUser(await headers());
if (!user) return <p>Signed out</p>;
return <h1>Welcome back, {user.name}</h1>;
}Retire the VPN
Every company has internal apps. They should be one URL behind your SSO, not a VPN. Host them in a sandbox, assign the right groups, done.
Connect your SSO once and your identity provider's groups flow into Buddy - and into every app you expose.
SSO docs
Test it right now
Create a sandbox from this YAML. It runs the example app with Buddy auth in front. Open the URL - that's you in the payload. Building with an agent? Paste the YAML into the prompt.
- sandbox: internal-reports
name: Internal Reports
os: ubuntu:24.04
apps:
- npm run start
endpoints:
- name: www
endpoint: 3000
region: EU
http:
auth_type: BUDDY
fetch:
- repository: https://github.com/buddy/identity-example
build_command: npm install && npm run buildAdd it to your app today
Install the package, call one function - everything else is already running in front of your app.