Stackure FAQ
Passwordless auth for B2B apps. Here's what people ask before they start.
Last updated October 13, 2026
What is Stackure?
Stackure is passwordless auth for B2B apps. It signs people in by email link or 6-digit code, with no passwords. It decides who can open each app through roles, teams and partner organizations, and it keeps an activity log of every sign-in and change. You add it to your app with an SDK for Go, JavaScript, Python or Rust, or with its HTTP API.
Who is Stackure for?
Stackure is for companies that build B2B apps and need to control which people, teams and partner organizations can open them. It suits apps your own staff use and apps you share with partners and customers, each in their own organization under yours.
How does sign-in work with Stackure?
Stackure signs people in without passwords. Your app sends them to Stackure, they enter their email and Stackure emails them a sign-in link and a 6-digit code. The link works for 15 minutes and the code for 10 minutes. Opening the link or entering the code sends them back to your app with a session token that works only for your app, and your server checks it with Stackure on each request. If they're already signed in to Stackure in that browser, they go straight back with no email. The SDKs handle all of this.
How long does a Stackure session last?
A Stackure session lasts up to 1 day. It ends sooner when the person signs out or signs in to Stackure again, since each person has one session at a time. Signing out ends the session everywhere: every app, every device and every connected AI client.
Does Stackure support passwords or SAML single sign-on?
No, Stackure signs people in only by email link or 6-digit code. It has no passwords and no SAML or OpenID Connect connections to other identity providers. A single Stackure sign-in opens every app the person can access.
How do roles and permissions work in Stackure?
Stackure gives each person roles, and each role is a set of permissions. The built-in roles are owner, app admin, user admin, partner admin, partner manager and auditor, and people who manage users can create custom roles. Roles decide what people can see and do in Stackure. In your own app, Stackure tells you who the person is, their organization, their teams and whether they're an app admin, and your app decides what they can do.
How does the Stackure account hierarchy work?
Stackure arranges organizations in a tree. Your organization sits under the platform's root organization, and the partner organizations you onboard sit under yours. Each organization has its own users, teams, roles and apps. Your app admins register apps and share them with partner organizations, whose app admins then choose who gets them. Partner organizations can't register apps or share them further down. People in an organization can see the organizations below it as their roles allow.
How does partner onboarding work in Stackure?
Stackure onboards partner organizations through signups you approve. A partner opens your signup link, enters a work email and gets a link to the full form, which works for 1 hour. The signup then waits as pending and notifies your signup approvers. Nothing is created until one of them approves it, which creates the partner's organization. Your server can also send signups with POST /api/public/signup and your organization's secret. Each partner organization has an access expiry, which partner admins can extend in its last 30 days, up to 90 days ahead, or end by closing the organization.
Does Stackure keep an audit trail?
Yes, Stackure keeps an activity log of sign-ins and changes, with who acted, when, the IP address, the browser user agent and any AI client involved. It covers sign-ins, people, roles, teams, apps and their secrets, sharing, partner organizations, signups, AI client connections and support requests, and each change records the fields that changed with their before and after values. The log is append-only: the database rejects edits and deletions, and entries are removed only after 1 year. People whose roles allow it can search the log in Stackure or read it through the Management API.
Which SDKs and languages does Stackure support?
Stackure has SDKs for Go, JavaScript, Python and Rust, plus an HTTP API described in OpenAPI. The Go SDK is net/http middleware for Go 1.27 or later. The JavaScript SDK works with Express, Connect or plain Node.js 22 or later. The Python SDK is ASGI and WSGI middleware for apps such as FastAPI, Flask and Django on Python 3.14 or later. The Rust SDK is tower middleware for axum, tonic and hyper on Rust 1.85 or later. The Go, JavaScript and Python SDKs have zero dependencies. Each SDK protects routes, takes the sign-in handoff, protects an MCP endpoint, lists who can open your app and signs people out.
Does Stackure have an API?
Yes, Stackure has 2 HTTP APIs. The Sign-in API under /api/public signs people in to your apps. The Management API under /api/internal runs your organization without the web app: users, teams, roles, permissions, apps and their secrets, partners, signups, AI access, support requests and the activity log. The reference is at https://stackure.com/docs/api and the OpenAPI spec at https://stackure.com/openapi.json.
Can AI clients use Stackure?
Yes, AI clients can use Stackure in 2 ways. Stackure runs an MCP server at https://stackure.com/mcp that lets Claude or another AI client look things up and make changes in your Stackure organization as you, within your roles, once your owner turns on AI access. Some changes, such as removing a person or deleting an app, run only after you approve them, and secrets are never sent to the AI client. Each SDK can also protect your own app's MCP endpoint, so AI clients sign people in through Stackure.
Where is Stackure hosted and where is data stored?
Stackure at https://stackure.com is hosted in the EU, and its database is stored in the EU. Each Stackure region is a separate deployment with its own address and database, and nothing is shared between regions. The email service, the apps people open and any AI providers they connect may process data in other countries.
How does Stackure keep data secure?
Stackure stores sign-in links, codes, tokens and secrets only as one-way hashes and shows each app secret once. Business logic, permission checks and the separation between organizations run inside PostgreSQL stored procedures, and every change is written to the append-only activity log. Pages are server-rendered with a Content Security Policy that allows only Stackure's own scripts, sign-in and API calls are rate limited and a session token works only for the app it was issued to. SDK releases are built by GitHub Actions and carry GitHub build provenance. To report a vulnerability, sign in and use Contact Support with "Security" in the subject.
Does Stackure sell data or use it to train AI?
No, Stackure doesn't sell personal information or use it to train AI models, and it has no ads or analytics. It uses only the cookies needed to sign people in.
What limits does Stackure have?
Stackure limits sign-in emails to 3 requests per minute and 5 requests per hour for each email and IP address, and opening links or entering codes to 10 requests per minute for each IP address. Session checks are limited to 1,000 requests per minute for each app, with as many again for MCP checks and for directory lookups. JSON request bodies can be up to 1 MB. Each organization also has limits on users, teams, apps, partner organizations and team memberships per person, shown under Organization · Limits.
What plans does Stackure have?
Stackure has 3 plans: Free, Pilot and Premium. You choose one when you apply, and each plan comes with limits on users, teams, apps, partner organizations and team memberships per person.
How do I start with Stackure?
To start with Stackure, go to https://stackure.com/signup. Enter your work email and Stackure emails you a link to the signup form, which takes about 1 minute. Every signup is read and answered by email. Once your organization is approved, register your app under Apps, give people access and add an SDK. The guide at https://stackure.com/docs walks through each step.
Who makes Stackure?
Stackure is from Mappstack, the registered business name of SY Innovations Pty Ltd, an Australian company.
What is Stackure built with?
Stackure is written in Go and runs on PostgreSQL. Business logic, permission checks and the separation between organizations live in PostgreSQL stored procedures, and the web app is server-rendered HTML. Its only direct dependency outside the Go standard library is the pgx PostgreSQL driver.
How does Stackure compare with Auth0?
Stackure and Auth0 both offer passwordless email sign-in, B2B organizations, roles and permissions, activity logs and sign-in for MCP servers, but Stackure is passwordless only and Auth0 offers more ways to sign in. Auth0 also has passwords, social sign-in and enterprise SSO with SAML and OpenID Connect, a free plan for up to 25,000 monthly active users and public cloud regions in the United States, the United Kingdom, Europe, Australia, Japan and Canada. Auth0 lists SDKs for Go, Python and Node.js but none for Rust. Stackure lets you onboard partner organizations under yours and share apps down to them, runs in the EU and has SDKs for Go, JavaScript, Python and Rust. Auth0 details checked on auth0.com in October 2026.
How does Stackure compare with Clerk?
Stackure and Clerk both offer sign-in by email link or code, organizations with custom roles and sign-in for MCP clients, but Clerk adds passwords, social sign-in and enterprise SSO while Stackure is passwordless only. Clerk's enterprise SSO needs its Pro or Business plan, and it has a free tier of 50,000 monthly retained users per app. Clerk is hosted in the United States and doesn't offer regional data residency. It lists backend SDKs for Go and Python and a community-maintained Rust SDK. Stackure keeps an append-only activity log for 1 year, is hosted in the EU and has its own SDKs for Go, JavaScript, Python and Rust. Clerk details checked on clerk.com in October 2026.
How does Stackure compare with WorkOS?
Stackure and WorkOS both offer passwordless email sign-in, organizations, roles and permissions, audit logs and sign-in for MCP servers, but WorkOS adds passwords, social sign-in and SSO with SAML or OIDC while Stackure is passwordless only. WorkOS signs people in by email with a 6-digit code it calls Magic Auth, where Stackure sends both a sign-in link and a 6-digit code. WorkOS User Management is free for up to 1 million monthly active users, and SSO and Directory Sync are priced per connection. WorkOS lists official SDKs for Node, Python, Go and Rust, among others. Stackure lets you onboard partner organizations under yours and is hosted in the EU. WorkOS details checked on workos.com in October 2026.
How does Stackure compare with Supabase Auth?
Stackure is a dedicated B2B auth service with organizations, partner onboarding, roles, teams and an append-only activity log built in, while Supabase Auth is the auth part of the Supabase platform. Supabase Auth offers magic links, email codes, passwords and social sign-in, plus SAML SSO on Pro plans and above. It is open source and can be self-hosted. You choose your project's region. Supabase documents roles and permissions as something you build with custom access token claims and database policies, and it lists official client libraries for JavaScript and Python and a community one for Go. Stackure has SDKs for Go, JavaScript, Python and Rust and is hosted in the EU. Supabase details checked on supabase.com in October 2026.
More detail is in the docs, the API reference and the privacy policy.