API-First Identity, KYC & Digital Locker for Developers
The all-in-one developer platform for Argon2id auth, FIDO2 passkeys, DigiLocker consent, and instant PAN, DL, RC, and GSTIN verification.
Built on Open Standards & Verified Indian Identity Infrastructure
Everything Required to Authenticate & Verify Users
Eliminate fragmented vendors. AuthSetu delivers user authentication, enterprise SSO, DigiLocker data exchange, and government credential verification in a unified platform.
Developer Auth & FIDO2 Passkeys
Turnkey authentication supporting Argon2id password hashing, TOTP MFA, WebAuthn biometric passkeys, and single sign-on with Google and enterprise OAuth.
const { userId } = await auth();Digital Locker & Document Retrieval
Seamless DigiLocker consent, OAuth token exchange, and authorized document discovery for Aadhaar, Class X/XII Marksheets, and Degree Certificates.
PAN, DL, Vehicle RC & GSTIN Verification
Realtime verification against authorized government databases with normalized error envelopes and confidence scores.
Ed25519 (EdDSA RFC 8037) JWTs
Compact 256-bit asymmetric tokens with public JWKS discovery at /.well-known/jwks.json, verified in microseconds on Edge runtimes without DB roundtrips.
Hierarchical Workspaces & Tenancy
Four-tier multi-tenancy: Workspaces -> Applications -> Isolated Environments (Dev/Staging/Prod) -> Instance Keys (pk_, sk_).
Reliable River Webhooks & HMAC
Guaranteed webhook delivery with Redis/River background queueing, exponential backoff, dead-letter monitoring, and HMAC-SHA256 signature verification.
How AuthSetu Works
From initial user sign-up to production government credential verification in four simple steps.
Initialize SDK & Client Keys
Configure your publishable and secret instance keys (pk_test_, sk_test_) in under 60 seconds with npm, pnpm, or pip.
Drop In Accessible Auth UI
Embed pre-built React widgets (<SignIn />, <SignUp />, <UserButton />) or authenticate via raw REST API endpoints.
Trigger DigiLocker & KYC Checks
Initiate consent-backed DigiLocker retrieval, PAN verification, Driving Licence, or Vehicle RC lookups with normalized schemas.
Verify Asynchronously via Webhooks
Receive tamper-proof HMAC-SHA256 signed webhook events dispatched from AuthSetu River queues with guaranteed at-least-once delivery.
Built by Developers, for High-Velocity Teams
AuthSetu eliminates boilerplate identity code. Native Edge-compatible helpers verify Ed25519 tokens in-memory without blocking remote database calls.
- Zero database network hops for JWT verification in Server Components
- Strongly typed TypeScript, Go, and Python SDKs
- Deterministic sandbox mocking for KYC and DigiLocker testing
// src/app/dashboard/page.tsx (Next.js 16 Server Component)
import { auth, currentUser } from '@authsetu/nextjs/server';
import { redirect } from 'next/navigation';
export default async function Dashboard() {
const { userId, role } = await auth();
if (!userId) redirect('/sign-in');
const user = await currentUser();
return <h1>Welcome back, {user?.name || user?.email} ({role})</h1>;
}Integrates with Your Entire Technology Stack
Official SDKs and turnkey bindings for Next.js, React, Node.js, Go, Python, and Indian government digital infrastructure.
Next.js App Router
First-class Server Components helpers with auth(), currentUser(), and Edge proxy middleware.
React 18 & 19
Accessible drop-in components including <SignIn />, <SignUp />, and <OrganizationSwitcher />.
TypeScript & Node.js
Fully typed REST client (@authsetu/api-client) with zero runtime dependencies and ApiError parsing.
Go (Golang)
High-performance standard library HTTP client with typed request envelopes and retry handlers.
Python
FastAPI and Django-friendly client with synchronous and asynchronous request support.
DigiLocker India
Direct citizen consent and document discovery for Aadhaar, Academic Certificates, and Vehicle Registrations.
Security Engineered at the Cryptographic Layer
We treat security as a non-negotiable architectural foundation. No plaintext secrets, no third-party telemetry, and zero unauthenticated data paths.
Memory-Hard Argon2id Password Hashing
Protects user credentials with 64MB memory hardness and 3 iterations, with automatic zero-downtime migration from legacy bcrypt hashes.
Ed25519 (EdDSA RFC 8037) Asymmetric Tokens
Compact 256-bit cryptographic keys with public JWKS discovery at /.well-known/jwks.json, verified in-memory using Web Crypto API.
Zero-Trust Indian Cloud Infrastructure
Hosted in AWS Mumbai (ap-south-1). Full DPDP Act compliance with ephemeral memory processing for DigiLocker documents.
Predictable Costs. Zero Surprise Overage.
Free developer sandbox with full DigiLocker and KYC simulation. Upgrade when you are ready to serve live users in India.
Prototyping & development with zero financial commitment.
- 100 Test Verifications / month
- Unlimited Sandbox API Keys
- Full DigiLocker & OCR Simulation
- EdDSA RFC 8037 JWT Verification
- Standard Rate Limits (10 req/sec)
- Community & Email Support
For fast-growing startups verifying Indian users in production.
- 2,500 Production Verifications included
- Extra verifications at ₹1.50 each
- Production DigiLocker, PAN, DL, RC & GSTIN
- Signed Webhooks with Replay Protection
- Up to 10 Workspace Team Members
- Compliant B2B GST Invoicing
High-throughput identity verification for scale-ups and NBFCs.
- 20,000 Production Verifications included
- Extra verifications at ₹0.90 each
- Unlimited Workspace Team Members
- Dedicated IP Allow-listing & Audit Trails
- High-throughput Concurrency Quotas
- Priority 99.9% Uptime SLA
Engineering Principles & Guarantees
Our architectural commitments to zero-trust security, performance, and Indian data sovereignty.
“We designed AuthSetu to give Indian developers the same developer experience they expect from global leaders, but with native DigiLocker, PAN, and local compliance built-in from day one.”
“Zero remote database lookups for session verification. Ed25519 asymmetric tokens verified natively via Web Crypto mean sub-millisecond edge response times on any cloud provider.”
Frequently Asked Questions
Clear answers about Indian regulatory compliance, token architecture, and DigiLocker integrations.