Use Case SaaS Startups

You have a product to ship, not an auth system to build

Canopy gives you authentication, role-based access control, and multi-tenant isolation from day one, with a clear path to hierarchical permissions when your customers outgrow flat RBAC.

Hours, not weeks Flat to start Hierarchy when ready

1 Day one

Flat RBAC

Admin, member, viewer. Live in hours.

2 Growth

Custom roles

Your own permissions, environment-wide.

adminmemberviewer

3 Enterprise

Hierarchy

Departments & regions. No migration.

Ship auth on day one

Your first integration takes hours, not weeks

Register an OAuth application, redirect users to Canopy's hosted login, and receive signed JWTs. Email verification, password reset, and session management are all handled for you.

Receive signed JWTs your app can verify

Verification, reset & sessions handled for you

Integration checklist ~2 HOURS

client_id · redirect_uri

Redirect to hosted login

PKCE · email verification built in

Receive & verify signed JWT

RS256 · JWKS endpoint

No password storage. No session plumbing. No reset emails to build.

Start with flat RBAC

Simple roles, exactly what early products need

Most early-stage products need simple roles: admin, member, viewer. Canopy's flat RBAC gives you exactly that: environment-wide roles with custom permissions. No hierarchy overhead until you need it.

Environment-wide roles, no tree required

Define your own custom permissions

Zero hierarchy overhead until you want it

Roles in Production

Admin

Full access

readwritemanage

Member

Create & edit

readwrite

Viewer

Read only

read

Grow into hierarchy

Enable hierarchy without a migration

When your enterprise customers need departments, teams, and regional access, enable hierarchy. Existing roles and assignments carry forward: no migration, no breaking changes. Your code doesn't change.

Today · flat roles

Your roles live environment-wide.

Admin

Environment-wide

Member

Environment-wide

Enable hierarchy

Later · same roles, now scoped

The exact same roles, assigned at nodes.

HQ West East SF LA

Your code doesn't change. Existing roles and assignments carry forward automatically.

Multi-tenant from the start

Multi-tenancy without building it

Every account is fully isolated. Your customers' data never intersects, and each tenant can configure their own roles and permissions independently.

Full isolation — customers' data never intersects.

Independent config — each tenant owns its roles & permissions.

Acme Logistics

Tenant A

dispatcher

fleet.manage

route.assign

Isolated

Northwind Health

Tenant B

clinician

chart.view

rx.approve