newauth is a passwordless Single Sign-On provider that replaces passwords, SMS codes, and authenticator apps with something fundamentally different: users sign in by clicking their secret spots on images they've chosen. No typing, no second device, no codes to intercept.
Under the hood it's standard OIDC + PKCE — the same protocol your existing identity stack already speaks. Drop newauth in as an identity source alongside or instead of what you run today. No migration, no rip-and-replace.
How it works for users: During onboarding, users pick a secret spot on each image in a set chosen by their organisation — typically between 6 and 12. At sign-in, newauth presents a random subset of those images, different each time. Users click their spot on each one shown. The random selection means observing one sign-in doesn't reveal enough to replay it. Muscle memory does the work — sign-ins take seconds and get faster with each visit.
How it works for security teams: There's no password database to breach, no SMS code to intercept, and no push prompt to fatigue-bomb. The credential is spatial and personal — it never transmits as a string, so it can't be phished the way a password can. Each user gets a pairwise pseudonymous identity per application, so cross-app tracking is structurally impossible.
What's included: Image-click authentication, unlimited sign-ins, session validation and step-up authentication, per-app pairwise privacy, and consent management on all plans. Paid plans add custom domain. The free plan supports up to 50 active users with no credit card required — paid plans start at $3.00/user/mo.
newauth is cloud-hosted. Pricing scales with active users: free up to 50, then $3.00/user/mo (Growth), $2.50 (Business, 2k–10k users), $2.00 (Scale, 10k–50k), and custom Enterprise above that.
