Signet
This instanceacme-corp.kapable.kapable.run

acme-corp.kapable.kapable.run runs Signet, a self-hosted authentication server. The accounts, sessions and credentials it holds belong to the organisation that operates this host.

What to do here

If an application sent you here, sign in or manage your account. If you are wiring an application to this server, start with the docs. If you run it, the operator door is below.

Where to go

Sign inThe sign-in page for accounts held by this instance. Applications normally send you here themselves.Your accountYour sessions and devices, password, two-factor, passkeys, and the applications you have connected. You will be asked to sign in first.Integrate an appQuickstart, the generated configuration reference, and every endpoint this instance serves. Written for the developer wiring an application to it.Operate this instanceUsers, organizations, delivery and audit for this server. For the people who run it.Check the claimsThe compatibility receipt this instance publishes, in human and machine form. Nothing on this page is asserted without it.
✦ Certification receipt recorded · 2026-07-22
Compatibility profile
better-auth 1.6.23
the better-auth release this instance was checked against
Certification gap
0
behaviours in the profile this instance does not match — 0 means it matched every one
End-to-end acceptance
14 / 14
checks passed in the stock-client end-to-end suite
Profile version
Signet compatibility profile v1
A recorded pointer to Signet's better-auth compatibility run, not an implied cryptographic attestation. It describes the run on the date above; it is not a live check of this server. Read the full receipt at /certification (JSON).

What this server does

It holds the accounts. Users, sessions and credentials live in this server’s own PostgreSQL. Nothing about them is sent to a third party, and no third party sits between an application and the people signing in to it.
It answers offline. These pages, the generated configuration reference and the machine on-ramp are all served from this one binary. A sealed network with no route to the internet gets the identical experience, at 2am.
It speaks stock better-auth. Applications built on the stock better-auth client work against this instance unchanged — no rewrite and no Signet SDK. Certification gap 0.

Wiring an application to this instance

  1. Write signet.toml with this instance's public origin and a Postgres DSN.
  2. Provide the secret and database URL out-of-band, then boot. Migrations run on start.
  3. Point the stock better-auth client's baseURL at /api/auth on this origin — no Signet SDK.

The full quickstart and the generated configuration reference live at /docs. Enlisting an AI agent to integrate for you? The machine on-ramp is /llms.txt.