---
title: "Inside Shorebird's upgraded auth service"
description: "Take control of your app's security with Shorebird's new authentication service offering flexible session management, scoped API keys, and robust audit logging."
url: https://shorebird.dev/blog/introducing-shorebirds-upgraded-auth-service/
---

[Blog](/blog)

[Product updates](/blog/category/product) March 9, 2026 2 min read

# Introducing Shorebird's upgraded auth service

New authentication service from Shorebird for flexible session management, scoped API keys, and audit logging.

![](/_astro/mac-carrithers.z7kWccT2_Z1yfQTj.webp)

Mac Carrithers

Software Engineer

Every company has unique security and authentication needs, to help meet those needs we’ve rolled out a new auth service: auth.shorebird.dev. This rollout marks a major step towards an upgraded authentication infrastructure designed to give you more control and peace of mind.

Previously we proxied third-party tokens. While functional, this approach limited your ability to set strict timeouts, revoke access on the fly, or audit active sessions.

Now Shorebird acts as its own identity provider giving us and you more flexibility in how authentication is managed. Behind the scenes, the auth service handles the OAuth exchange, issues Shorebird’s own short-lived JWTs and refresh tokens making authentication more adaptable to your specific security posture.

With the authentication foundation in place we will be adding new capabilities in the coming weeks and months. Here is a sneak peek to what’s on the horizon.

* **Complete session management:** Lose a device? Soon you’ll be able to see all your active logins across devices and browsers and instantly revoke any open session.
* \*\*Scoped API keys:\*\*You want your CI/CD pipelines and third-party tools to work smoothly, but they shouldn’t hold the keys to the kingdom. In the coming weeks you can create API keys with limited functionality – like the ability to deploy a patch without the dangerous permission to delete a release.
* \*\*Comprehensive audit logging:\*\*Keep a close eye on account activity with audit logs. See what actions were taken in your account and by which users, to ensure security compliance.
* **SAML support:** Configure single-sign on with our authentication provider.

If you are interested in any of these capabilities or have other authentication needs [please reach out](/talk-to-sales), we would love to hear about your requirements.

## More from the blog

[All posts](/blog)

* Product updates Oct 30, 2026 2 min read

  ### [Orgs at Shorebird just got better](/blog/orgs-at-shorebird-just-got-better)

  Shorebird now has one kind of organization. Your personal org works like any other org, and org membership replaces app collaborators.

  ![](/_astro/wesley-peck.C4oaIDVg_ZANUra.webp)

  Wesley Peck

  Lead Product Manager

* Product updates Oct 29, 2026 5 min read

  ### [Your CI shouldn't run on someone's personal key](/blog/service-accounts-for-ci)

  Service accounts give your release pipeline its own identity in your organization, with a fixed role and keys that keep working as your team changes. On GitHub Actions, you can drop the stored key entirely.

  ![](/_astro/abhishek-doshi.DveI0bx__ZfWpAX.webp)

  Abhishek Doshi

  Developer Relations Engineer

* Product updates Oct 26, 2026 4 min read

  ### [Shorebird's got your back: patch signing is now on by default](/blog/patch-signing-on-by-default)

  A compromised certificate authority put apps that bundle their own trust list at risk. Here's how it affects Shorebird apps, and why every new release is now signed by default.

  ![](/_astro/wesley-peck.C4oaIDVg_ZANUra.webp)

  Wesley Peck

  Lead Product Manager

## Ship your first patch today.

Install the CLI, create a release and send a patch. Free for 5,000 patch installs a month.

[Start for free](https://console.shorebird.dev/login) [Read the quickstart](https://docs.shorebird.dev/getting-started/)

Larger team? [Talk to sales](/talk-to-sales)