Choose your auth
Same passwordless email UX. Different token model for the client that needs it.
TuraLogin
Passwordless email for websites and apps
Two API calls. Start sends a magic link or code. Verify confirms identity. You own the session.
- Magic link + OTP
- Backend-only tokens
- You set the cookie
TuraMCP
Passwordless auth for remote MCP
Users prove email. Cursor and Claude get Bearer tokens. Your MCP server validates them.
- mcp_live_ PATs today
- OAuth / JWKS next
- Auth only, not a tool host
When to use which
Use TuraLogin when a human signs into your website or API and you create the session cookie yourself after verify.
Use TuraMCP when Cursor, Claude, or another MCP client must send Authorization: Bearer on every /mcp request.
Do not put website magic-link flows on the MCP URL. Keep app login and MCP auth as separate products.