---
title: "Pylon Auth: magic-link, OAuth, OIDC, and row-level policies"
description: "Magic-link, 25+ OAuth providers, OIDC, guest sessions, and API keys are built in. Row-level policy expressions live next to your schema and run on every read and write."
url: "https://www.pylonsync.com/product/auth"
---

Auth & access control

# Auth and access rules, built in.

Magic-link email, 25+ OAuth providers, generic OIDC for any IdP, guest sessions, and API keys are built in. Policy expressions live next to your schema and gate every row in the hot path.

[Create your account →](https://cloud.stack0.dev/signup)[Read the docs](https://docs.pylonsync.com)

schema.ts — a policy

```


import { policy } from "@pylonsync/sdk";

 

const messagePolicy = policy({

  name: "message_access",

  entity: "Message",

  allowRead: "true",

  allowInsert: "auth.userId != null and data.authorId == auth.userId",

  allowUpdate: "false",

  allowDelete: "data.authorId == auth.userId",

});

```

- Magic-link, Google / GitHub / Apple / Microsoft / Discord / Slack and 20+ more
- Generic OIDC discovery for any enterprise IdP; SAML SSO on Cloud
- Guest sessions and API keys for public apps and machine clients
- Row-level policies compile to bytecode and run on every read and write

## How it works.

01Every provider, one config02Policies that can't be bypassed03Multi-tenant without the footguns

providers

Magic linkGoogleGitHubAppleOIDC

session · auth.userId set

Turn on magic-link and a wall of OAuth providers from the same auth() block. Generic OIDC discovery means any IdP that publishes a discovery document works without a bespoke integration. Guest sessions let anonymous users interact before they sign up; API keys authenticate scripts and machine clients.

## What you’d otherwise wire up.

Each line is a piece teams normally assemble for this one capability. On Pylon it is part of the runtime.

- A hosted auth provider and its SDK on every client
- Session storage, refresh, and revocation handling
- Route middleware that re-checks permissions on each endpoint
- A second rules language for row-level access

## Apps built with it.

Scaffold any of these with `npm create @pylonsync/pylon`.

[All examples →](/developers/examples)

liveMarketplace

A trading marketplace deployed from a monorepo, with listings, watchlists, an activity feed, faceted search, and per-user ownership.

Faceted searchfield.owner()Optimistic inserts

template: marketplace[Open](https://market.pyln.dev) 

SaaS starter

A complete SaaS product with a marketing site, onboarding, a multi-tenant dashboard, and Stripe billing. Reach for this one to build a product.

Stripe billingMarketing + dashboardOnboarding

template: saas

Consumer app

A social feed with live posts and likes, public reads, and owner-only writes.

Live feedPublic readsfield.owner()

template: consumer

Keep exploring

[Database

Typed schema. Migrations on save.](/product/database)

[Server functions

Backend logic in TypeScript.](/product/functions)

[Sync engine

Live queries over WebSocket.](/product/sync)

## Build it on Pylon.

One framework for your schema, sync, auth, functions, realtime, and SSR. Free to start.

[Create your account →](https://cloud.stack0.dev/signup)[Read the docs](https://docs.pylonsync.com)