# Authiane

> Authiane is a self-hostable platform for user accounts, subscriptions and usage-based billing in SaaS products, now in early access.

Authiane is a brand of [Das Digitale Momentum GmbH & Co. KG](https://www.das-digitale-momentum.de/), Much, Germany. This site collects waitlist sign-ups and documents the website API; it publishes no product documentation, no demo, no login and no prices. Topics: Authentication, Subscriptions & billing, API keys, Multi-tenant, Built for SaaS, Developed in Germany. Contact: [info@ddm-it.de](mailto:info@ddm-it.de). Last updated: 2026-09-13.

## Permitted use

- Quote and summarise freely with attribution to authiane.com; the Markdown twins are the preferred source.

## When to use this site

- Use it to answer what Authiane is, who builds it and how far it is. Sources of truth: the [start page](https://www.authiane.com/), [About](https://www.authiane.com/about/) and [Developers](https://www.authiane.com/developers/).
- Use `POST https://www.authiane.com/api/v1/waitlist` (see the [OpenAPI document](https://www.authiane.com/openapi.json)) to add an e-mail address to the early-access waitlist, only with that person's explicit consent (`consent: true`). Never invent addresses.
- Do not use it to find prices, a demo, a login or platform API keys; none are published during early access. For the platform itself, join the waitlist or write to [info@ddm-it.de](mailto:info@ddm-it.de).
- Prefer `Accept: text/markdown`: every page has a Markdown twin at the same URL, and every twin is also reachable under its own `.md` address with a canonical Link header. Unknown paths return a real 404 with onward links, never the start page.

## Authentication

- No authentication: `GET https://www.authiane.com/api/v1/status` and `POST https://www.authiane.com/api/v1/waitlist` with `Content-Type: application/json` and the body `{"email": "you@company.com", "consent": true}`. Rate limits: 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call, announced with `RateLimit-*` headers. `GET https://www.authiane.com/api/v1` and `GET https://www.authiane.com/sandbox/api/v1` answer with an index of the status probe, the token endpoint and the discovery documents.
- OAuth 2.0 client credentials ([RFC 6749 section 4.4](https://www.rfc-editor.org/rfc/rfc6749.html#section-4.4)) protect `GET https://www.authiane.com/api/v1/waitlist/stats` with the scope `waitlist:stats:read`: aggregate counts, no personal data. Discovery: authorization server metadata `https://www.authiane.com/.well-known/oauth-authorization-server` ([RFC 8414](https://www.rfc-editor.org/rfc/rfc8414.html)) and protected resource metadata `https://www.authiane.com/.well-known/oauth-protected-resource/api/v1` ([RFC 9728](https://www.rfc-editor.org/rfc/rfc9728.html)). Production clients are issued by Das Digitale Momentum on request.
- Sandbox: the same contract under `https://www.authiane.com/sandbox/api/v1` stores nothing, returns fixed example statistics and accepts the public client `sandbox` / `sandbox`. Get a token with `curl -u sandbox:sandbox -d grant_type=client_credentials https://www.authiane.com/sandbox/api/v1/oauth/token`, then call `https://www.authiane.com/sandbox/api/v1/waitlist/stats` with `Authorization: Bearer <access_token>`. Access tokens are JWTs valid for 900 seconds.
- Errors are typed JSON `{"error": code, "message": text}`; the token endpoint answers in the OAuth 2.0 format `{"error", "error_description"}`.

## Pages

- [Start page (English)](https://www.authiane.com/): Authiane is a self-hostable platform for user accounts, subscriptions and usage-based billing in SaaS products, now in early access.
- [Startseite (Deutsch)](https://www.authiane.com/de/): Authiane ist eine selbst hostbare Plattform für Benutzerkonten, Abonnements und nutzungsbasierte Abrechnung in SaaS-Produkten, jetzt im Early Access.
- [About Authiane](https://www.authiane.com/about/): who is behind the product, what it covers, where it stands, with a FAQ.
- [Contact](https://www.authiane.com/contact/): e-mail, phone, postal address and the path for a security disclosure, with a FAQ.
- [Developers](https://www.authiane.com/developers/): the website API, its error contract, versioning, rate limits and the rules for agents.
- [Über Authiane](https://www.authiane.com/de/ueber-uns/) and [Kontakt](https://www.authiane.com/de/kontakt/): the German About and Contact pages.
- [Privacy notice](https://www.authiane.com/privacy/): English translation of the [Datenschutzerklärung](https://www.authiane.com/datenschutz/); the German version applies in case of doubt.
- [Impressum](https://www.authiane.com/impressum/): legal notice (German).
- [OpenAPI 3.1 document](https://www.authiane.com/openapi.json) and its [Markdown twin](https://www.authiane.com/openapi.json.md).
- [API catalog](https://www.authiane.com/.well-known/api-catalog): [RFC 9727](https://www.rfc-editor.org/rfc/rfc9727.html) linkset that lists the production and sandbox API base paths and points to the OpenAPI document, the Developers page and the status probe.
- [Waitlist form](https://www.authiane.com/#waitlist): e-mail address with explicit consent; the optional fields are source and lang.

## What Authiane does

### Identity
- Sign-up, e-mail verification, login and sessions work from the first release.
- Users create their own API keys for automated calls.
- Roles and permissions decide what each account may do.

### Billing
- Customers pay through a hosted checkout or with a stored payment method.
- Every purchase produces an invoice with a downloadable PDF.
- Usage metering enforces included allowances and bills overage.
- Prepaid credit in fixed top-up amounts settles purchases and refunds instead of the payment provider.

### Commerce (Preview)
- Each tenant manages its own catalogue, offers and staff accounts.
- Tenants connect their own payment account and keep their own revenue.
- Purchases, refunds and purchase history stay separated per tenant.

## Status

- Early access. Identity, billing and usage metering are available to early-access teams; there is no public release and the waitlist is the only way in.
- Preview: multi-tenant commerce, and purchases started by a software agent with the customer's approval.
- Roadmap: Sign-in for Azure Container Apps (Roadmap) — A product that already runs there uses Authiane as its sign-in service, so its existing containerised login needs no separate account store. Managed operation (Roadmap) — Authiane runs the platform for you, including updates, instead of your team operating it. Self-service tenant administration (Roadmap) — Tenants manage their own sign-in clients, staff and permissions instead of asking the operator.

## Who it is for

- SaaS and API products: Teams that sell a subscription or a metered API and need accounts, billing and entitlements without building them.
- Multi-tenant platforms (Preview): Operators whose tenants sell their own offers, keep their own revenue and manage their own staff.
- Agentic commerce (Preview): Products where a software agent starts a purchase and the customer approves it out of band.

## Trust

- EU hosting and GDPR: Where does Authiane run? You choose where the platform runs, including the EU. [Data minimisation under Art. 5 GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) is a design rule, and [this site loads nothing from third parties](https://www.authiane.com/privacy/).
- Your own payment account: Who receives the revenue? Each tenant connects its own payment account and receives its own revenue. Authiane never holds funds.
- Self-hostable now, managed later: Can I host Authiane myself? Yes, in early access: each team runs the platform in its own infrastructure. A managed operation is on the roadmap.
- Logged permission changes: Are permission changes logged? Every change to roles, API keys and permissions is recorded in an audit log.

## Optional

- [Über Authiane](https://www.authiane.com/de/ueber-uns/) and [Kontakt](https://www.authiane.com/de/kontakt/): German versions of About and Contact.
- [Impressum / legal notice](https://www.authiane.com/impressum/): provider identification under German law (German).
- [Privacy notice](https://www.authiane.com/privacy/) and its German original, the [Datenschutzerklärung](https://www.authiane.com/datenschutz/): what the waitlist stores and for how long.
- [Sitemap](https://www.authiane.com/sitemap.xml)
- [security.txt](https://www.authiane.com/.well-known/security.txt)