Latch Vector
Latch Vector is a multi-tenant SSO and identity service for software that treats who can do what as a first-class security boundary — strong tenant isolation, permissions scoped to an organization, and an audit trail of access changes.
It gives you:
- Hosted authentication — email/password, MFA (TOTP), and social login, with short-lived access tokens and rotating refresh tokens.
- A real organization tree — parent/child orgs with row-level isolation, so a parent can administer its children and nothing leaks sideways.
- Roles & permissions scoped to an organization (this org, or the whole subtree), enforced at the token.
- First-class SDKs for Node, Python, PHP, and Java/Spring — every endpoint is reachable without hand-writing HTTP.
How the pieces fit
| Concept | One line |
|---|---|
| Application | An audience your tokens are issued for. One per service (or group of services) that verify tokens together. |
| Organization | A tenant, or a sub-tenant beneath it. The isolation boundary. |
| User | A person in an organization. Signs in, gets tokens. |
| Role | A named set of permissions, scoped to an org (self or subtree). |
| Access token | Short-lived JWT (RS256), carries the user, org, and granted permissions. |
| Refresh token | Long-lived, single-use, rotating credential that mints new access tokens. |
Two clients, one service
Every SDK ships two clients:
SsoClient— the auth surface. No token needed:login,refresh,logout, MFA verify, social login, password reset.ManagementClient— the management surface, authenticated with a management access token: users, organizations, roles, applications, API clients, webhooks, audit, bulk import, user data export & erasure.
Start with a quickstart, skim the concepts, and keep the API reference open beside you.
note
This site documents the public API and SDKs. Deployment, the internal service-to-service channel, and operator runbooks are intentionally not here — they live with the operators, not on the open internet.