What does SealGate do?

SealGate is an API and browser SDK for adding passkeys (FIDO2 / WebAuthn, using biometrics such as Touch ID or Windows Hello) to an existing login. It handles registration, authentication, revocation and recovery. Your users' names, email addresses and your login screen stay with you.

Does SealGate store user data?

SealGate stores only the mapping between public keys and your user IDs, and authentication records. It does not receive names or email addresses.

How is pricing determined?

Pricing is step-based: your monthly price is set by the band your monthly active users (MAU) fall into. Up to 1,000 MAU: free; 1,001–10,000 MAU: $65 per month; 10,001–100,000 MAU: $350 per month; 100,001+ MAU: $350 per month (USD, excluding tax). No setup fee, and no charges for devices or API requests.

What happens when a user loses their device?

After you verify the user's identity on your side, issue a recovery token. The user can then register a passkey again on a new device. SealGate does not verify identity.

Can I integrate SealGate using an AI agent?

Yes. There is an MCP server (https://api.sealgate.jp/v1/mcp) and a skill (https://sealgate.jp/skill/SKILL.md). Give them to Claude Code, Cursor or a similar agent, and it can carry out the integration and manage users and keys with its tools.

Add passkey login
to your service with one API

A passkey authentication platform built and operated in Japan. The API and SDK handle the hard parts of registration, authentication, revocation and recovery.
Your user data and your login screen stay with you.
Remove passwords without handing your data to an overseas IDaaS.

Get started free Contact

Why SealGate

You want to avoid an overseas IDaaS, but building WebAuthn yourself is a lot of work. SealGate covers the space in between: a platform built and operated in Japan that provides only the authentication part.

What changes with a passkey platform

Problems with your current login

With SealGate

Reused passwords and phishing lead to account takeovers. Most support requests are "I can't log in."
01Log in with device biometrics
Log in with Touch ID, face recognition or Windows Hello. Set a transition period and phase out passwords step by step.
The WebAuthn spec is complex, and device differences slow you down. Designing key revocation and recovery for lost devices is hard to get right.
02Registration, authentication, revocation and recovery through an API
SealGate handles the hard parts. The browser SDK deals with device differences, and your server only relays JSON.
With an overseas IDaaS, you hand over your users' data. Contract and internal policy reviews take time.
03Your users' data stays with you
SealGate stores only the mapping between public keys and user IDs. Names and email addresses stay in your database. Your contract is with a company in Japan.

How it compares

When SealGate fits

You want to add passkeys to your existing login
You want to keep user data in your own systems
You want contracts, billing and support from a company in Japan
You want to own the design of your login screens
You need recovery for lost devices as well

When an IDaaS fits

You want to hand off the whole login screen
You want SAML and social login in the same place
You can entrust user data to a provider overseas
Support from overseas works for you

When building your own fits

You have engineers dedicated to authentication
You can limit the devices and browsers you support
You can run recovery in-house
You cannot use any external service

Only the authentication part, as a service

The browser SDK talks to the device, and your server calls the SealGate API. The API key stays on your server and is never sent to the browser.

User's device

Browser SDK

Biometrics

Passkey (private key)

Your server

User data

Session issuance

API key

SealGate

Registration and authentication API

Signature verification

Public key storage

Revocation and recovery

Audit log

Tenant isolation (RLS)

Dashboard

Users and devices

Recovery policy

Audit log viewer

MAU usage

1The SDK starts the device's biometrics and creates a signature
2Your server relays the signature to SealGate
3SealGate verifies it and returns the user ID. Your server issues the session

Talk to us

Works with any language or platform that can make HTTP requests

Server (REST API)

Node.js
Next.js
Ruby
Rails
PHP
Laravel
Python
Django
Go
Java
Spring
.NET

Client (browser SDK)

Chrome
Safari
Firefox
iOS
Android
macOS

Works in browsers and operating systems that support passkeys

Server SDKs

Node.js
npm install sealgate-server
Go
go get github.com/shannonllc/sealgate-go
PHP
composer require shannonllc/sealgate

Python: Coming soon

Server SDKs

Integrate with an AI agent

Give these two URLs to an MCP-capable agent such as Claude Code or Cursor, and it can carry out the integration. The agent connects after you log in and approve it in the browser. Its tools cover creating projects and API keys, managing users and keys, recovery and the audit log.

MCP
https://api.sealgate.jp/v1/mcp
Skill
https://sealgate.jp/skill/SKILL.md

Claude Code plugin and list of tools

Pricing

Your monthly price is set by the band your monthly active users (MAU) fall into. Free up to 1,000 MAU. No setup fee, and no charges for registered devices or API requests. All prices are in USD and exclude tax.

Usage-based

Pay for what you useCard payment (Stripe), billed monthly

Monthly active users (MAU)	Per month
Up to 1,000	Free
1,001–10,000	$65
10,001–100,000	$350
100,001+	$350

Your MAU in each billing period (one month from the day you add a card) sets the band, and we bill that band's price. There is no plan to choose. Above 100,000 MAU, the price stays at $350. Enterprise plans are available on request.

Use up to 1,000 MAU without a payment method (stops at the limit)
Add a card to remove the limit. You pay only the price of that month's band
Unlimited apps, 1-year audit log, email support (reply within 2 business days)

Get started free

Enterprise

Custom pricing

Quote based on your scale, paid by card
Dedicated environment, custom contracts
Dedicated contact, 99.9% SLA