Product · Thoryn

Core capabilities

Four modules. One identity layer.

Whether you run a single app or a project chain of dozens of organizations, the platform is the same.

Single sign-on

SSO

One login across every application and partner. Sign in once, reach everything you are cleared to see, and nothing you are not.

OIDCSAML 2.0OAuth2

OIDC and SAML 2.0 connections
Enterprise and social identity providers
Session management and single logout
Hosted login, branded to your organization

Directory sync

SCIM

Access that keeps up with your teams. As people join or leave a project, their accounts and permissions follow automatically.

SCIM 2.0

SCIM 2.0 provisioning and deprovisioning
Group and role mapping
Real-time synchronization
Instant offboarding when a user leaves

Authentication

Auth

Strong authentication without touching your code. MFA and passkeys, on by default and phishing-resistant by design.

WebAuthnPasskeysTOTP

Multi-factor authentication
Passkeys and WebAuthn
Adaptive step-up authentication
Session and device controls

Authorization

Fine-grained access

The right access, down to the project and the file. Define policy once, enforce it across every service.

RBACABACPolicy engine

Role and attribute-based policies
Per-resource permissions
Central policy, distributed enforcement
Full audit trail on every decision

The differentiator

Cross-organization federation.

The layer WorkOS, Ory, and Okta do not have. Give a municipality, its contractors, and their suppliers shared, governed access to a project, without anyone surrendering their own directory. Every organization keeps control of its users. Every action stays auditable.

Developer experience

Built for developers. Live in five days.

From first call to production in five working days, not a quarter.

A few lines to production identity.

Standard protocols and a clean SDK. Drop SSO, directory sync, and authorization into your app in an afternoon, not a rebuild.

Works over OIDC, SAML, and SCIM.

auth.ts

import { Thoryn } from "@thoryn/sdk";

const thoryn = new Thoryn({ region: "eu-central" });

// Send a user into SSO
app.get("/login", (req, res) => {
  const url = thoryn.sso.authorizationUrl({
    connection: "acme-oidc",
    redirectUri: "https://app.example.eu/callback",
  });
  res.redirect(url);
});

// Exchange the code for a verified profile
app.get("/callback", async (req, res) => {
  const { user } = await thoryn.sso.exchange(req.query.code);
  req.session.user = user; // stored in the EU, always
  res.redirect("/dashboard");
});

Day 1 · Kickoff

Map the stack

We review your apps, identity providers, and requirements.

Day 2 · Connect

Wire up SSO

Single sign-on and directory sync connected to your apps.

Day 3 · Configure

Roles and audit

Policies, fine-grained access, and audit logging in place.

Day 5 · Live

In production

Running on EU infrastructure, ready for your users.

Everything WorkOS and Ory do. Without leaving Europe.