OthviaSign inStart free
Identity for B2B apps

Sign-in that knows where every user belongs.

Passkeys for people, SSO for the companies they work for, and one login page on your own domain. Othvia picks the right way in from the email address, before anyone types a password.

Start freeRead the quickstart
Passkeysand MFASAML · OIDCenterprise SSOSCIMdirectory syncYour domainauto TLS
auth.larkspurhr.comlogin.sparrobook.comauth.yourapp.com
LLarkspur HR

Welcome back to Larkspur.

Payroll, leave and reviews for 300+ teams.

SSparrobook

Your road to payday.

Bills and subscriptions, before they charge you.

YYour app

Your brand, your domain.

Logo, colors, copy and emails. No Othvia badge.

Work or personal email
kestrel.com→Kestrel Logistics→OktaSAML 2.0
Domain kestrel.com is verified for Kestrel Logistics.
meridian.rs→Meridian Freight→Microsoft Entra IDOIDC · SCIM
Accounts come from their directory. Leavers lose access within minutes.
gmail.com→Personal account→PasskeyWebAuthn
Personal address with a passkey saved on this phone.
halvorsen.no→Halvorsen & Co.→Email codeSSO not set up yet
Their IT admin can connect Okta or Entra from a setup link. No call with us.
or
GoogleGitHub
Try
Universal LoginHosted, white-label, on your domain
OrganizationsYour customers, each with their own rules
Self-serve SSOTheir IT admin connects it from a link
WebhooksSigned, retried, with a dead-letter queue
React SDKDrop-in sign-in and org switcher
MCP serverAI agents with scoped tokens
Your side · the console

Every app, customer and connection on one map.

Othvia keeps each product in its own realm and each customer in its own organization. When a customer’s SSO breaks, you see it here first, and their IT admin can fix it without you.

APPLICATIONS

◧Larkspur HR WebSPA · code + PKCE
▯Larkspur iOSNative · code + PKCE
⇄Payroll SyncM2M · client credentials
✦Larkspur AssistantMCP client · DPoP
REALM · PRODUCTIONLarkspur HRlarkspur.othvia.com

Passkey 41% · Password 22% · Google 19% · SSO 12%

ORGANIZATIONS · SSO

Dev and production realmsSeparate keys, users and settings. Promote a configuration when it’s ready.
Health you can act onBroken metadata, expiring certificates and failed syncs show up before users report them.
Audit logEvery sign-in, setup-link change and admin action, with who and from where.
Their side · the IT admin

Their IT admin sets up SSO. You stay out of it.

Send a setup link from the console. The admin gets six steps written for their identity provider, tests a real sign-in and turns on directory sync. No shared screens, no ticket ping-pong.

01Written for their provider. Okta, Entra ID, Google Workspace, OneLogin, JumpCloud or any SAML 2.0 provider.
02Tested before it goes live. Nobody is sent to the new connection until a test sign-in passes.
03Scoped and expiring. The link changes one organization’s connection, nothing else, and stops working after 7 days.
LConnect Kestrel Logistics to Larkspur HROpened by it@kestrel.comlarkspur.othvia.com/setup

Which identity provider does Kestrel use?

The next steps are written for that provider’s admin console, with its own menu names.

OktaMicrosoft Entra IDGoogle WorkspaceOneLoginJumpCloudOther SAML 2.0

Create Larkspur HR in Okta

In Okta admin open Applications → Create App Integration, choose SAML 2.0 and paste these values.

Single sign-on URLhttps://larkspur.othvia.com/sso/saml/kestrel/acsCOPY
Audience URIhttps://larkspur.othvia.com/sso/saml/kestrelCOPY
Name ID formatEmailAddress

Give us the metadata

It tells Larkspur HR where to send people and which certificate signs their sign-in.

Metadata URLhttps://kestrel.okta.com/app/exk51907/sso/saml/metadata
✓Metadata read. Signing certificate valid until March 2028.

Match the attributes

Which SAML attributes from Okta fill in each person’s Larkspur HR profile.

Emailemailrequired
First namefirstName
Last namelastName
Groupsgroups

Test it with your account

We check the signature, audience and your attributes before anyone else is sent to Okta.

✓Signed in as it@kestrel.com. Signature valid, audience matches, 4 attributes and 2 groups received.

Keep people in sync

Optional. With SCIM, Okta creates people in Larkspur HR before their first sign-in and signs them out when you deactivate them.

SCIM base URLhttps://larkspur.othvia.com/scim/v2/kestrelCOPY
Bearer tokennot generated yet

Keep people in sync

Optional. With SCIM, Okta creates people in Larkspur HR before their first sign-in and signs them out when you deactivate them.

SCIM base URLhttps://larkspur.othvia.com/scim/v2/kestrelCOPY
Bearer tokenscim_7Qd2…f39aSHOWN ONCE

Kestrel Logistics signs in with Okta

From their next sign-in, people from @kestrel.com go to Okta. Email codes stop for that domain.

ProviderOkta · SAML 2.0
Email domain@kestrel.com
User syncOn first sign-in
✓Larkspur HR was notified. The connection shows green on their realm map.

Kestrel Logistics signs in with Okta

From their next sign-in, people from @kestrel.com go to Okta. Email codes stop for that domain.

ProviderOkta · SAML 2.0
Email domain@kestrel.com
User syncSCIM 2.0 · 96 people, 4 groups
✓Larkspur HR was notified. The connection shows green on their realm map.
Step 1 of 6 · link expires in 7 daysStep 2 of 6 · link expires in 7 daysStep 3 of 6 · link expires in 7 daysStep 4 of 6 · link expires in 7 daysStep 5 of 6 · link expires in 7 daysStep 6 of 6 · link expires in 7 daysStep 6 of 6 · link expires in 7 daysDone · this link still works until 12 NovDone · this link still works until 12 Nov
For developers

A few lines in your app. Events when anything changes.

Drop in the React components, let AI agents manage realms through a scoped MCP server, and get signed webhooks when a connection fails or someone leaves a customer’s directory.

import { OthviaProvider, SignIn, OrganizationSwitcher } from '@othvia/sdk-react' <OthviaProvider realm="larkspur"> <OrganizationSwitcher /> <SignIn /> // passkeys, SSO routing, MFA </OthviaProvider># Management MCP server for AI agents url https://mcp.othvia.com auth OAuth 2.1 · DPoP-bound token scope orgs:read connections:read setup_links:write # the agent can list Kestrel's connection and send # a setup link. It cannot read users or secrets.POST https://api.larkspurhr.com/hooks/othvia Othvia-Signature: t=1762338120,v1=5f2c…a91e { "type": "connection.failed", "organization": "kestrel", "reason": "idp_metadata_unreachable" }
Webhook deliveries · api.larkspurhr.com
09:41:11session.revoked200 · delivered
09:41:10user.deprovisioned200 · delivered
06:14:38connection.failed200 · delivered
06:12:35connection.failed503 · retry in 2 min
06:12:04connection.failed503 · retry in 30 s
@othvia/sdk-reactSign-in, sign-up, organization switcher and profile components. Server helpers verify the session in one call.
DPoP tokensAccess tokens bound to the client’s key, so a copied token doesn’t work from another machine.
Management MCPAI agents get OAuth tokens limited to the scopes you grant: list organizations, check connections, send setup links.
Signed webhooksHMAC signature and timestamp on every delivery. Failed deliveries retry with backoff, then wait in a dead-letter queue you can replay.
Standard protocolsOAuth 2.1, OpenID Connect, SAML 2.0 and SCIM 2.0. Nothing proprietary between your app and your users.
Pricing

Enterprise SSO, priced like a feature.

Your first SAML connection and its SCIM directory are free. After that, each connection is a flat monthly price, and adding one never moves you to a bigger user tier.

What is a retained user?Someone who signed in at least once this month and kept their account for more than 24 hours. Inactive accounts cost nothing.
Can I run it myself?Sovereign runs in your own cloud on your PostgreSQL, licensed per cluster.
↧Coming from Auth0? Import users with their bcrypt hashes. Nobody resets a password, and auth0|… IDs stay in the token’s sub.

What would you pay?EUR · monthly

Retained userssigned in at least once, kept 24 h+25,000
SSO connectionseach with its SCIM directory5
ProUp to 5 realms, one custom domain, DPoP tokens, signed webhooks.
€127 / moQuote
25,000 retained usersincluded
1 SSO + SCIM connectionincluded
5 SSO + SCIM connectionsincluded
Pro plan€49
25,000 retained usersincluded
0 more users · €2 per 1,000, once€0
3 SSO + SCIM connectionsincluded
2 more × €39€78
Scale plan€249
25,000 retained usersincluded
5 SSO + SCIM connectionsincluded
0 more × €25€0
Annual license per clusterquote
Retained users, SSO and SCIMunlimited
Databaseyour PostgreSQL
Start freeContinue with ProContinue with ScaleTalk to us about Sovereign

Early pricing, subject to change before general availability.

Free€050,000 users, 1 SSO + SCIM, dev and prod realmsPro€49100,000 users, 3 connections, custom domainScale€249250,000 users, 10 connections, Management MCPSovereignlicenseSelf-hosted, unlimited, per cluster

Give every customer their own way in.

Start freeTalk to us about Sovereign