Hexclave handles everything user, from passkeys to payments
Before a new SaaS product does anything interesting, it has to do a pile of things that are not interesting at all. Users need to sign up and sign back in. They need to invite teammates and control who can touch what. Somebody has to charge them, email them receipts, and notice whether they ever came back.
None of that is the product. All of it is mandatory. And the standard way to get it in 2026 is to assemble a committee of vendors: one service for sign-in, another for billing, another for transactional email, another for product analytics. Each one keeps its own copy of the user. Each one syncs with the others over webhooks. The seams between them are where the weird bugs live, like the customer who canceled in the billing system but still gets onboarding emails, or the teammate who was removed from the workspace but whose API key still works.
Hexclave is built on the idea that this is one problem pretending to be five. The company calls itself a user infrastructure platform, and its pitch is a single sentence: you choose the frontend, backend, and database, and Hexclave handles everything else. Everything else, here, means everything attached to the user record. Authentication, teams, permissions, API keys, payments, emails, analytics, all running against one shared user model instead of five private ones.
It is an ambitious scope for a company most developers met under a different name.
From Stack Auth to Hexclave
Hexclave launched out of Y Combinator's Summer 2024 batch as Stack Auth, with a Launch HN titled "open-source user authentication that doesn't suck." The framing was a direct shot at the managed identity providers: Auth0 and Clerk owned the convenient end of the market, but Clerk is entirely proprietary, and teams that wanted convenience without handing their user table to a third party had thin options. Stack Auth offered the polished developer experience of those tools as an open-source project you could self-host.
The launch worked. The Product Hunt debut in August 2024 took #3 Product of the Day, and the GitHub repository has since grown to around 6,900 stars. One Hacker News commenter reported moving a web app off Clerk in a matter of hours, which is the kind of migration story an auth company would pay for if it could.
Then, quietly, the name stopped fitting. The company rebranded to Hexclave, stack-auth.com now redirects to hexclave.com, and the repository moved from stack-auth/stack-auth to hexclave/hexclave. Companies rename themselves for lots of reasons, but this one reads as a statement of scope. Stack Auth described a feature. Hexclave is a bet that the feature was always a wedge into something bigger.
Auth was the wedge
It was a well-chosen wedge, because authentication is where the user record is born. Whoever creates the user object has a structural advantage in everything that touches it afterward.
The auth layer itself covers what you would expect from a modern provider: passkeys, OAuth sign-in through Google and GitHub, magic links, and CLI authentication for developer tools. Auth methods are toggled from a dashboard rather than wired up by hand.
What made it more than a login box is that the adjacent primitives shipped alongside it. Teams come built in, with workspaces, email invites, and role-based permissions. The RBAC system supports nestable roles, and the same permission check runs on the server or the client, so an app does not need two parallel authorization codepaths that drift apart. API keys are shown once at creation, and Hexclave automatically revokes keys it detects have leaked.
Teams, roles, and keys are exactly the features that make a patchwork stack hurt. A billing provider needs to know what a team is to bill per seat. An email service needs to know who admins are. When each vendor invents its own version of these concepts, the glue code multiplies. When they hang off one user model, they are just fields.
Then it kept absorbing jobs
The current product reads like a catalog of the services a SaaS team would otherwise sign up for one by one. Hexclave organizes them as apps you enable as needed, all built on the shared user model.
Payments handles subscriptions, one-time charges, and usage-based metering with credits, billable to an individual or a team. Emails sends transactional and marketing mail through one API, with open and click tracking. Analytics shows live active user counts and session replays, and lets you build dashboards by describing them in plain English or by writing SQL. Around the edges sit signed webhooks with retries and backoff, a Data Vault for server-only storage of user secrets, and a launch checklist that walks through pre-production chores like domain setup and secret rotation.
The individual features are table stakes in their individual markets. The argument is the combination. Usage metering that already knows which team a request came from does not need a sync pipeline. An email API that already knows the user's subscription state does not need a webhook integration to avoid dunning a customer who already paid. Session replay tied to the actual user record, rather than an anonymous visitor ID that gets stitched together later, skips a whole category of identity-resolution work.
Every integration a team does not have to build is also a bug class it does not have to debug. The five-vendor stack fails at the seams. Hexclave's design removes the seams by refusing to have five systems in the first place.
Open source is doing real work here
It would be easy to read the open-source positioning as marketing garnish. For this product, it is closer to the foundation.
User infrastructure is the least comfortable thing to rent. The user table is the business. A proprietary vendor that holds it has leverage over pricing and a veto over your architecture, and migrating away means re-verifying every account. This is precisely why teams hesitate over managed identity providers, and it is the hesitation Stack Auth was created to catch.
Hexclave's answer is structural rather than rhetorical. The code carries an MIT and AGPLv3 license split across its SDKs and server components, the repository ships a Docker setup for self-hosting, and the company runs a managed cloud at app.hexclave.com for teams that would rather not operate it themselves. You can hold your own user data on your own Postgres, or pay Hexclave to run the same stack. Either way the exit door stays visible, which is paradoxically what makes teams comfortable walking in.
The ecosystem today centers on React and Next.js, with JavaScript SDKs and a backend built on Next.js and Elysia. One independent review of the platform called it a promising, developer-friendly open-source auth platform for modern React and Next.js products, while steering heavily regulated deployments toward older vendors for now. That is a fair snapshot of where a 2024-vintage platform stands, and it maps to a deliberate choice: Hexclave is built for the modern web stack first, where most new SaaS products actually start.
A small team with a shipping habit
Hexclave is based in San Francisco with a team of about seven. It was founded by Konstantin Wohlwend and Zai Shi. Wohlwend, the CEO, is a repeat Y Combinator founder whose background runs through ETH Zurich, Google, Jane Street, and Bloomberg.
The public engineering cadence is easy to audit, because the development happens in the open. The hexclave/hexclave repository shows changelog entries landing week after week through late 2026, with Wohlwend's handle on the commits. For an infrastructure product asking companies to build their user layer on it, a visible pulse matters as much as any feature. Dead open-source projects are easy to spot, and so are alive ones.
The name got bigger because the job did
There is a familiar pattern in developer infrastructure where a company wins a wedge, then discovers the wedge was the hard part. Getting developers to trust you with authentication is brutally difficult, since auth is the one system nobody wants to think about and everybody is afraid to touch. Once that trust exists, extending it to billing or email is a much shorter conversation.
Hexclave is running that pattern deliberately. The pieces of the user stack were never separate because they needed to be; they were separate because different companies got to them at different times. A product built after passkeys, usage-based pricing, and session replay all existed can treat them as one surface.
Whether every team wants its payments and its analytics from the same platform that does its auth is the open question, and the catalog design hedges it: each app is opt-in, and the auth layer stands alone for teams that only want a Clerk alternative. But the rebrand tells you where the company thinks this goes. Stack Auth was a product name. Hexclave is a bet that "everything user" is a category, and that the open-source project that owns the user model ends up owning the category.
