Launch HN: Xkit (YC S18) – OAuth infrastructure as a service

I've been looking for this for a while -- love it.

a) is SalesForce integration in the queue? Our primary use case is syncing customer records

b) i presume since you store the tokens, there's massive vendor lock-in right? just wondering how we might be at the mercy of your team (e.g., if you got acquired, raised prices, etc)

I think you're onto something big! At first I thought this was Auth0-like, so I suppose something more obvious in the landing page copy might help (e.g., "Build integrations into your SaaS apps in minutes")

So I have to trust your company with valid access tokens for all of my users. No thanks.

Maybe its just me but all I can see with your company is the tumblr extension xkit. https://chrome.google.com/webstore/detail/new-xkit/inobicegh... But i'm sure you've already discovered this :p

Congratulations on the launch! I'll probably end up being a customer as our product will integrate with multiple external services (Salesforce, Intercom, Calendly).

Now an off topic question: how did you stay motivated as a solo founder through 2 years and 2 pivots? Was it always just you, or did you have other co-founders that ended up leaving?

I'd love to have some competition for Auth0 so this is good.

But, what I'd love is an Auth service that does what you do for Office365 accounts. For some reason, nobody does this and, at least in Auth0, you have to manually set up O365 as a custom OIDC provider.

If I'm not mistaken, OAuth 2 does not support multiple clients, but in this case the token authorized by a user ends up being known by 2 clients: Xkit, and Xkit's customer. What exactly is being shown in the consent screen the user accepts? Are users aware that they grant scopes to 2 distinct parties? Couldn't this be considered abuse by the SaaS Apps themselves?

great stuff. you do have a security problem, which you've acknowledged. so you won't get customers that actually are invested in security. fortunately, that's a scant few. you shouldn't waste efforts chasing them. just do the right [security] things, which will satisfy the 99% that aren't complaining. you will never ever be able to address the actual security conscious because, well, you can't.

I build a lot of integrations, so this looks useful. Would this allow you to do something like build the My Apps / My Connections screen found in Zapier?

Congrats on the launch. Are there plans for SDKs in various languages or is this going to be JS only for now?

Why I ask is that I like the simplicity of Firebase as a back-end and attempted to use Google Auth for a desktop app (in C++). It was a pain to setup and still doesn’t work well.

It would save us a great deal of dev effort if there was a layer which could talk to Google and handle this for me.

P.S. The part about trusting a ‘startup’ with auth tokens may be worth addressing in some way on your website.

I think there's a huge, growing need for this and your sdk/api's seem very well-thought!

As for the design of your site, it definitely leaves me assuming it's just an auth service. I'd focus more on showing psuedo example interfaces / flows that your service powers. For instance, show an example client app on the left, your sdk drops in, on the right your integrations UX showing all the apps you can now integrate with.

I'm reminded of the copy & explanatory / storytelling on this site: https://www.freshpaint.io/

Instead of "Codelessly connect your site to your stack" they could've said "Enterprise-grade analytics with less configuration." But they went with a phrase that does more to highlight how their offering is new and brings a new form of value.

Maybe a/b test your one-liner? Some ideas:

"Add 25+ SaaS integrations to your app. We take care of the authentication."

"The first low-code, secure way to add SaaS integrations FAST."

"A new, low-code way to add 25+ SaaS integrations to your app."

"Less time re-implementing auth, more time building features."

"A faster, more secure approach to integrations."

Good luck!

Not trying to be critical or anything but the design really reminds me of those domain-name parking pages - like this: https://bit.ly/2DRc04H

Their terms:

THESE SERVICES ARE PROVIDED BY COMPANY ON AN “AS IS” AND “AS AVAILABLE” BASIS. COMPANY MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE OPERATION OF THEIR SERVICES, OR THE INFORMATION, CONTENT OR MATERIALS INCLUDED THEREIN. YOU EXPRESSLY AGREE THAT YOUR USE OF THESE SERVICES, THEIR CONTENT, AND ANY SERVICES OR ITEMS OBTAINED FROM US IS AT YOUR SOLE RISK.

NEITHER COMPANY NOR ANY PERSON ASSOCIATED WITH COMPANY MAKES ANY WARRANTY OR REPRESENTATION WITH RESPECT TO THE COMPLETENESS, SECURITY, RELIABILITY, QUALITY, ACCURACY, OR AVAILABILITY OF THE SERVICES. WITHOUT LIMITING THE FOREGOING, NEITHER COMPANY NOR ANYONE ASSOCIATED WITH COMPANY REPRESENTS OR WARRANTS THAT THE SERVICES, THEIR CONTENT, OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE SERVICES WILL BE ACCURATE, RELIABLE, ERROR-FREE, OR UNINTERRUPTED, THAT DEFECTS WILL BE CORRECTED, THAT THE SERVICES OR THE SERVER THAT MAKES IT AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS OR THAT THE SERVICES OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE SERVICES WILL OTHERWISE MEET YOUR NEEDS OR EXPECTATIONS.

COMPANY HEREBY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR PARTICULAR PURPOSE.

THE FOREGOING DOES NOT AFFECT ANY WARRANTIES WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.

EXCEPT AS PROHIBITED BY LAW, YOU WILL HOLD US AND OUR OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS HARMLESS FOR ANY INDIRECT, PUNITIVE, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGE, HOWEVER IT ARISES (INCLUDING ATTORNEYS' FEES AND ALL RELATED COSTS AND EXPENSES OF LITIGATION AND ARBITRATION, OR AT TRIAL OR ON APPEAL, IF ANY, WHETHER OR NOT LITIGATION OR ARBITRATION IS INSTITUTED), WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE, OR OTHER TORTIOUS ACTION, OR ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, INCLUDING WITHOUT LIMITATION ANY CLAIM FOR PERSONAL INJURY OR PROPERTY DAMAGE, ARISING FROM THIS AGREEMENT AND ANY VIOLATION BY YOU OF ANY FEDERAL, STATE, OR LOCAL LAWS, STATUTES, RULES, OR REGULATIONS, EVEN IF COMPANY HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. EXCEPT AS PROHIBITED BY LAW, IF THERE IS LIABILITY FOUND ON THE PART OF COMPANY, IT WILL BE LIMITED TO THE AMOUNT PAID FOR THE PRODUCTS AND/OR SERVICES, AND UNDER NO CIRCUMSTANCES WILL THERE BE CONSEQUENTIAL OR PUNITIVE DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE PRIOR LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU.

First, congrats! Launching anything is hard, let alone after two pivots. I had a couple of questions and comments:

* Are you looking to explicitly support other auth providers (I for one would love to have you support https://fusionauth.io/ -- full disclosure I work for them)? Or is the best path forward there to just use the Custom Token Issuer instructions?

* There's a typo here where it looks like the markdown hasn't been correctly processed: https://docs.xkit.co/docs/custom-catalog:

> If you want full control over how users interact with the Integration Catalog beyond what's available in [Self-hosting(doc:self-hosted-catalog), you can use our libraries or APIs to fully customize the experience.

* I'm trying to understand why someone would create their own catalog. Is that because they have their own suite of applications currently using OAuth for auth? So kind of a AWS Service Catalog play? Or is it more "I'll take care of adding this fiddly integration to XYZ service once so that all my developers can use this integration in the varied apps they are building"?

* What is the difference between using xkit and a tool like Zapier to handle SaaS integration? It looks like with xkit you have more control, including over the integration process. Why would I want to use something lower level like xkit?

Again, congrats on the launch!

Trey - congrats on the launch! Love what you are doing and cant wait to see how you evolve it. Integrations are definitely a PITA and Oauth2 is a great starting point! Best wishes!

When are you getting a SOC2 audit? Can I deploy to my own private cloud?