Secure sessions,
zero compromise.
EternalEngine uses RS256-signed JWT tokens for stateless, scalable authentication. Tokens are cryptographically verified on every request. Keys rotate automatically. Sessions expire on your schedule.
Authentication designed to scale
Stateless, verifiable, and secure — from your first user to your ten-thousandth.
RS256-Signed Tokens
Tokens are signed with an RSA private key and verified with the public key. Asymmetric signing means even a compromised microservice cannot forge tokens — only the auth service holds the private key.
Automatic Key Rotation
RSA keypairs rotate on a defined schedule. Old keys are retained briefly for in-flight token validation, then retired. No manual key management. No rotation downtime.
Configurable Expiry
Access tokens expire after a short window (configurable, default 1 hour). Refresh tokens extend sessions without re-login. Short access token lifetimes limit blast radius of any token leakage.
Refresh Token Policies
Refresh tokens are stored hashed, single-use (rotated on each use), and bound to a device fingerprint. Suspicious refresh attempts trigger an immediate session revocation and alert.
Stateless. Scalable. Secure.
JWT authentication means no session state to manage, no single point of failure, and no shared secret to protect.
Stateless Security
No server-side session store means no shared state to attack. Each token is self-contained and cryptographically verifiable. Scale horizontally without any session synchronization overhead.
Scalable Auth
Token verification is a pure cryptographic operation — fast, parallel, and requiring no database lookup per request. Auth adds microseconds, not seconds, to your request latency.
Tamper-Proof Sessions
Any modification to a JWT payload invalidates the RS256 signature immediately. A tampered token is rejected before it touches any business logic — no injection, no privilege escalation.
Common questions, straight answers.
How are sessions secured?
Sign-in issues a signed JWT with an expiry; every request is verified for signature and expiry and the tenant is taken from the token, never from the request.
Is MFA available?
Yes. Two-factor authentication can be enabled per user, and administrators can require it.
Do you support single sign-on?
SSO / SAML is included on Business and Enterprise.
Run your business from one place.
Five plans, seventeen launch apps, one dashboard. Set up in under 5 minutes — change tiers any time.
From $0 · Basic $9.95/mo · Save 20% on annual billing · Upgrade or downgrade any time