Passwordless authentication API: features and pricing

The account features available to your website

Passwordless here means no application-specific password to collect or store. The app still receives a sensitive session credential that must be protected. The service should not be described as eliminating every credential or every security responsibility.

Registered domains instead of developer API keys

Each person has one Gammal Tech account, and every account requires national ID verification. Existing account holders reuse that account on participating websites. The national ID number and verification documents remain private from developers. The owner creates a project in the Developer Console and registers the website’s HTTPS domains. The integration does not require a secret developer API key; its project ID is public configuration.

A project supports up to four domains. The bare domain and its www version count separately, as do additional subdomains. Browser API requests for account features must come from this whitelist of registered HTTPS domains. List the site addresses your product needs before choosing how to organize its projects.

Guest payment links are a separate public, shareable flow. They can be opened from anywhere without a secret API key or a domain whitelist. Sharing the same link does not change the receiving owner.

This is a configuration feature of Gammal Tech. When comparing services, evaluate each provider’s own setup requirements, supported account flows, limits, and pricing rather than assuming they all follow one model.

What to expect across tabs and devices

Sessions are kept per browser tab. Opening a fresh tab or reopening the browser requires another sign-in. Sign-out clears the local session; the documented behavior should not be presented as a guarantee that every device is signed out at once.

Persistent user data is separate. After the customer signs in on another device, your project can retrieve only the data it previously stored for that same account. This lets an app restore preferences or progress without treating a temporary session as a permanent customer identifier.

Saved experiences and privacy limits

The user-data service supports up to 1 MB per user. Suitable uses include language preferences, bookmarks, learning progress, compact settings, and small drafts. It is not a promise of unlimited file storage or a complete shared business database.

Gammal Tech does not disclose the customer’s underlying account name, email address, phone number, national ID number, or identity documents to your project, through login or a separate API lookup. If your app needs an email for another purpose or asks someone to complete a profile, it can request that information directly from the customer. This is a separate collection by your app, not disclosure of Gammal Tech account details. Free-text documents and support forms can therefore still contain personal information.

Authentication and storage costs

Currency guide: Listed EGP prices are the billing amounts. USD figures are approximate, using USD 1 = EGP 51.78, the calculated midpoint of Banque Misr’s USD buying and selling rates on 24 September 2026. Your payment provider’s exchange rate and fees may differ.

The code allowance includes codes sent during login and checkout identity verification, and resets monthly. Paid usage comes from the project balance: add funds to your personal wallet, then transfer them into the project. The first project is free; additional projects have a one-time fee shown in the Console.

For example, if a project sends 300 qualifying login or checkout verification codes in a month, 200 are included and the additional 100 cost 40 EGP (approx. US$0.77). This example covers code usage only; other paid services have their own charges.

Decide whether the service fits your product

• Match the account model. Customers sign in with a Gammal Tech account rather than a password created only for your website.
• Define the saved experience. Choose compact preferences and progress within the per-user limit.
• Plan business permissions. Paid access, private records, and administrative actions need appropriate controls beyond a valid sign-in.
• Account for existing customers. Plan any relationship to current records; automatic migration is not documented.

Common questions