Hexclave

Key features

• Passkey, OAuth, and magic-link authentication Email and social login ship with magic links and passkeys, custom branding, and OIDC and OAuth SSO with custom providers, toggled from the dashboard without code changes.[1][2]

• Teams and workspaces with real gating Workspaces, email invites, and roles cover multi-user products, with a workspace switcher that remembers selection and permissions that hold up under audit.[1]

• Nested-role RBAC with one permission check Roles nest and a single permission check works identically on server and client, defined in the dashboard and enforced anywhere in code.[1]

• Leak-safe API keys Keys work for users and teams, show the full secret only once, are never stored in plaintext, and leaked keys get auto-revoked.[1]

• Payments without separate codepaths Subscriptions, one-time charges, and usage metering with credits bill a person or a whole team through one model.[1]

• Email that reports back Transactional and marketing sends share one API with an AI-assisted template editor, one theming pass, and open and click tracking on every send.[1][2]

• Analytics with replays out of the box Live active-user counts and session replays come with one flag, with plain-English dashboard building and SQL-saved queries, metered per plan.[1][2]

• Signed webhooks and a server-only data vault Every user event emits a signed, tamper-proof webhook with retries handled, while user-supplied secrets stay encrypted so the platform never sees plaintext.[1]

Who will love it

• Prebuilt auth components, the shared user model, and the CLI dev workflow remove per-subsystem builds for Next.js, React, and TanStack Start products shipping login, teams, and billing fast.[1][2]

• Free self-hosting of the entire stack with per-platform Docker images and an AGPLv3 server keeps identity, secrets, and analytics on the operator's infrastructure.[1][2]

• The free tier covers 10,000 auth users while Team and Growth add admins, email volume, analytics headroom, onboarding calls, and support SLAs for scaling startups.[1]

Who should avoid it

• The app catalogue covers standard login, teams, and RBAC, but bespoke provisioning, legacy-directory, or complex federation needs may outgrow the documented apps.[1][2]

• Official SDKs target Next.js, React, plain JavaScript, and TanStack Start, with other runtimes served only through the REST API.[1]

• With no Reddit or G2 reports found in this pass and adoption figures limited to the vendor's own pages, there is little independent confirmation of day-to-day behavior at scale.[1][2]

Alternatives and compatibility