Add passwordless login and access control to a website, app, API, or server. Use an approved-email list, Stripe customer status, or your own rules to decide who gets in.
what it does
JamAuth proves who someone is, then checks whether they should be allowed in. Magic links answer the first question. Your approved-email list, Stripe account, or application answers the second.
Your code still decides what a signed-in person can see or do. JamAuth gives it a verified identity and an access decision.
what you can use it for
Put part of a blog, course, community, or website behind paid access.
Protect an admin area, internal dashboard, client portal, or team-only application.
Use the verified identity in your own code to give different people different privileges.
Keep files, releases, paid resources, and private documents out of public URLs.
01 paste the login widget
Drop it where the login should appear. JamAuth sends the email, verifies the link, and creates the session.
<div id="jamauth-login"></div>
<script
src="https://api.jamauth.com/jamauth.js"
data-client-id="YOUR_CLIENT_ID"
data-host="https://api.jamauth.com"
data-target="#jamauth-login"
></script>02 protect the route
Before the route opens, your server asks one question: is this signed-in person allowed?
/.netlify/functions/protected-pageThe starter includes the callback, session check, and protected route as a working reference.
how access is granted
Add addresses from the dashboard. No billing setup and no extra code. Good for beta lists, client previews, private tools, and protected files.
Keep checkout, pricing, and subscriptions in Stripe. JamAuth uses active customer status to decide whether the signed-in email gets access.
Keep the access rule in your own application. JamAuth calls a webhook you control, and your code answers yes or no — use another payment provider, a role, a plan, a license, or any record you already have.
The login stays the same. Only the source of the access decision changes.
what your users see
Once someone has access, signing in is simple: enter an email, click the magic link, and return signed in. No password to create, remember, reset, or store.
where it runs
The login script goes anywhere you can add a tag. The gate — the part that actually refuses access — runs wherever you can run a small server-side check: Netlify, Vercel, Render, or your own server.
Webflow, WordPress, and plain HTML sites work too, with a serverless route added alongside them. A script on its own can hide a page; it cannot protect one.
why I made it
I kept needing login and access control in my own projects, and I was tired of every project turning into an authentication project. JamAuth is the part I wanted to stop rebuilding.
removing it is three steps
Your content, Stripe account, and access rules stay with you. There is no password database to unwind and no application framework to migrate away from.