Auth + RBAC for EU SaaS builders.
Stop rebuilding the same identity layer. Userbox gives you authentication, workspaces, groups, roles, and permission checks — all from one API. Built in the Netherlands, hosted in the EU.
# Python SDKallowed = await client.access.check( user_id="ub_user_123", workspace_id="ub_ws_456", permission="finance.payables.approve") if allowed: process_payment(invoice)You've solved this problem before.
Start simple
Login form. Password. A user table. Looks manageable.
Product grows
Teams. Admin roles. Workspaces. Permissions per context.
The wall
You've built this before. You know how long it takes. How badly it can go wrong.
One API call answers the hard question.
Register your permissions in Userbox. Assign them to users, groups, or roles inside a workspace.
Then ask Userbox: can this user do this thing here? Userbox resolves the full permission chain — direct grants, group membership, role inheritance — and returns a simple answer. Your application enforces it.
# Python SDKallowed = await client.access.check( user_id="ub_user_123", workspace_id="ub_ws_456", permission="finance.payables.approve") if allowed: process_payment(invoice)Everything the identity layer needs.
Nothing it doesn't.
Authentication
The basics, done right. No edge case left to you.
- Email + password signup and login
- Session management —
JWT+ refresh - Token rotation and security baked in
- Invite flow with configurable destination
- Custom auth pages per environment
Workspaces + Users
Multi-tenancy the way every real SaaS app needs it.
- Multi-tenant model from day one
- Workspace-scoped memberships
- Groups per workspace
- User invitations + flows
- Custom registration fields per workspace
RBAC + Access checks
Authorization that scales with your product.
- Named roles and permissions
- Group inheritance
- Direct user grants
- Workspace-scoped resolution
POST /v1/access/check— one call, one answer
The only auth platform built in Europe, for Europe.
Dutch company
OsbxTech B.V. is incorporated in the Netherlands — not a European subsidiary of a US parent. The original company.
EU infrastructure
All data stays in the EU. No US hyperscalers. No Schrems II complications. Your legal team gets a clean answer.
GDPR by design
Compliance isn't a checkbox we tick. It's in how the platform was built from day one.
Pay as you grow.
An MAU is a user who logged in at least once this month. If your product has no users, you pay nothing. When users arrive, you grow with them.
- Up to 1,000 MAU
- Production environment
- Full auth, RBAC and custom registration fields
- Python + TypeScript / React SDKs
- Community support
- No credit card required
- Includes 10,000 MAU, then
€0.02 / MAU - Production + Staging + Development
- Audit logs and webhooks
- Email support
- Everything in Free
- Includes 50,000 MAU, then
€0.015 / MAU - Multiple workspaces (multi-product)
- SSO when available — included at this tier
- Priority support
- Everything in Builder
How many monthly active users?
Drag the slider. We'll show you the tier and the bill — including overage at your level.
"I kept rebuilding the same auth + RBAC layer across personal projects. The third time, I refused. Userbox is what I wished existed — built by a developer who felt the pain, for developers about to feel it."
Alex M. · Founder, OsbxTech B.V.
Drop it in. Ship the same day.
If you're building in Cursor, Bolt, or Lovable, Userbox is designed to be the first thing you wire up. A starter template and Cursor rules — your agent writes Userbox-correct code automatically.
The starter template
One docker compose up and you have a Next.js + Python SaaS scaffold with Userbox already wired. First permission check fires in under 10 minutes.
Cursor rules
Drop our rules file in .cursor/rules and your agent writes Userbox-correct code: SDK API, permission patterns, workspace model. Zero hallucinated endpoints.