Cloud based identity management for the users of your product
Cloud based identity management means the accounts of your users, their roles and the record of their sign-ins live in a service that someone else runs, rather than in a table and a set of scripts inside your own application. The Skycloak Platform is that service for software companies, and this page explains what it keeps for you and what stays in your code.
What moves out of your application
Most products start with a users table, a password hashing library and a reset email. Over time that grows into account recovery, multi-factor authentication, a list of sessions to revoke and an audit trail that a customer's security team asks to see. Each of those is security work that has to be right every time, and none of it is the reason your customers buy your product.
With the Platform, the user record lives in your tenant and your application keeps only the user's identifier next to its own data. Your code asks the Platform who the user is through OpenID Connect and reads the roles from the token it receives, so the identity logic stops being something your team maintains line by line.
Managing users from the console and the API
Your support and operations people work with users in the console: finding an account, checking its recent sign-ins and resetting a factor. The same actions are on the Management API, so your own admin screens or scripts can create users, assign roles and remove access without anyone opening the console.
For business customers, inbound SCIM is on the plan: their IT team adds or removes people in Entra, Okta or any SCIM 2.0 directory, and the change reaches your tenant without a ticket to your team. Each customer's directory groups map to that customer's roles, so a person removed from a group loses the role in that organization only.
Where the identities are kept
Each tenant runs in the United States or in the European Union, and its region is fixed when you create it. Tenants are kept apart by row-level security in the database itself, so a query for one tenant cannot read another tenant's users even if the application code above it makes a mistake.
We describe a feature as available only once it has shipped, so a demo is where you see which parts of the plan you can use today.
Frequently asked questions
Does my application still need a users table?
Usually yes, but a small one. It holds the user's identifier from the Platform and the data that belongs to your product, while passwords, factors and sessions stay in your tenant.
Can I choose where user data is stored?
Yes. You choose the United States or the European Union when you create a tenant, and the tenant stays in that region.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.