Migrate to Axowl

Axowl imports the users you export from your current auth provider with one API call per 500 users. Because Axowl end-user login is passwordless (magic link, social login, passkey), migrated users don’t reset anything: they sign in with the same email they always had, and Axowl matches them to the imported account automatically.

Pick your provider

Coming from	Export difficulty	Guide
NextAuth / Auth.js	None — the data is already in your database	NextAuth →
Clerk	Self-service CSV from the dashboard	Clerk →
Kinde	Self-service JSON from the dashboard	Kinde →
Supabase	Your own `auth.users` table	Supabase →
Firebase	One CLI command (`auth:export`)	Firebase →
Auth0	Export via API; hashes need a support ticket (allow ~1 week)	Auth0 →

How the import works

POST /api/public/v1/end-users/import
X-Api-Key: ah_live_…

{
  "appGroupId": "…",
  "source": "clerk",
  "sendInvites": false,
  "users": [
    {
      "email": "kim@example.com",
      "displayName": "Kim",
      "sourceUserId": "user_2abc…",
      "passwordHashAlgorithm": "bcrypt",
      "passwordHash": "$2b$10$…"
    }
  ]
}

Auth — an ah_live_ Org API key. App-group-scoped keys work, but only for their own App Group.
Batching — max 500 users per request; loop for more. Each row answers independently with created, duplicate, or invalid, so a bad row never sinks the batch.
sourceUserId — your old provider’s user id, stored so you can re-map foreign keys in your own database. The response returns the new Axowl endUserId per row.
sendInvites — false (default) is the silent migration: users simply sign in next time. true sends each created user a magic-link invite immediately.

What happens to password hashes

Axowl accepts bcrypt/scrypt/PBKDF2/Argon2 hashes and stores them dormant — recorded for provenance, read by no login path. Your one chance to capture the hash snapshot is at export time, so hand them over now even though Axowl doesn’t need them to sign users in.

Why you don’t need them: on their next visit, a migrated user signs in with magic link to the same email address (which also verifies the account), or with the social provider they already used — Axowl links social logins by email. From there, Axowl prompts them to register a passkey. Migrating to Axowl is how your users stop having passwords at all.

After the import

Enable the login methods your users expect (social providers, magic link, passkey) on the App Group — see Social login and Passkeys.
Re-map your foreign keys from sourceUserId to the returned endUserId (each guide shows the SQL shape).
Cut over your app to the Axowl SDK, then decommission the old provider.