Riverbed
Trace every API call back to the line that made it
Drop-in auth that does not own your user table
Keyring handles sessions, OAuth providers and MFA while your users stay in your own database. No vendor lock-in on the one table you cannot afford to lose.
Keyring sits in the auth corner of most stacks, and is aimed at teams who have outgrown doing this part by hand. It runs on Web and CLI, and is free to start with paid tiers for teams.
The source is public, so the parts you depend on can be read, forked and audited rather than taken on trust.
Your database, your schema, and 14 oauth providers preconfigured, totp and passkey support, self-host or use the managed edge. The setup is deliberately small: the maker's argument is that a tool you have to schedule a migration for is a tool you will not adopt.
Whether that holds for your team depends on what you already run. The listing below and the feedback from other makers are the fastest way to find out.
Feedback is public and shown to the maker.
Sign inBeen using this on a 40-table schema all week. The rollback generation alone saved me twice. One request: a dry-run flag that prints the SQL without touching anything.
The plain-language summaries are the killer feature. My non-technical PM can review migrations now, which I did not expect to ever type.
Works well with Postgres. MySQL support felt a bit behind, the enum diffing missed a case for me. Filed an issue and got a response the same day.