Introducing Auth Interceptors

Scalekit now supports custom validation logic at every critical point in your authentication flows

Authentication requirements don't fit in a box. You need domain restrictions for enterprise deals. Invite-only registration for controlled launches. Custom token claims for your microservices. Approval workflows for compliance.

Most auth systems force you to build these as workarounds—middleware that polls your database, cron jobs that clean up invalid sign-ups, or custom logic scattered across your codebase.

That's why Scalekit now offers Auth Interceptors: drop-in extension points that let you inject your own business logic directly into the authentication flow.

Why it matters

Authentication is where security policies, business rules, and user experience intersect. Interceptors give you control at the exact moments that matter:

• Block unwanted sign-ups before they create organizations
• Enrich tokens with custom claims before sessions are created
• Enforce team limits before invitations go out
• Add security checks before M2M tokens are issued

No more hacks. No more workarounds. Just clean, testable logic at the authentication layer.

‍

What's included

Four Strategic Trigger Points

Attach interceptors at Pre-Signup, Pre-Session Creation, Pre-User Invitation, and Pre-M2M Token Creation. Scalekit calls your endpoint, waits for your decision, and proceeds accordingly.

Custom Token Claims

Add roles, permissions, organization metadata, or feature flags directly to access tokens and ID tokens. Your services get enriched tokens without additional API calls.

Flexible Fallback Behavior

Choose whether to allow or block authentication flows if your endpoint fails or times out. You control the trade-off between availability and security.

Built-in Testing

Test interceptors before deploying to production. View exact request payloads, validate responses, and iterate without affecting live traffic. Test requests don't appear in production logs.

Comprehensive Audit Logs

Every interceptor request and response is logged with timestamps, success/failure status, and response times. Perfect for debugging and compliance.

Works with any HTTPS endpoint

You don't need a special SDK or framework. Register any HTTPS endpoint that can respond to POST requests. Scalekit sends the event context, your code makes a decision, and the flow continues or stops based on your response.

Get Started

Navigate to the Interceptors tab in your dashboard. Choose your trigger point, enter your endpoint URL, set your timeout and fallback behavior, then test it. When you're ready, toggle Enable.

You'll find:

• Step-by-step setup guides for each trigger point
• Example request and response formats
• Pre-built testing environment
• Complete audit trail

Start building with interceptors. Learn more in the interceptor docs.

‍