Daily canary tests for OAuth sign-in

The idea

When Sign in with Google breaks, nothing else does: the app is up, health checks are green, error rates look normal, and 100% of new signups are failing on a consent screen your monitoring never sees. The breakage usually is not even your deploy, it is Google tightening a verification rule, an expired client secret, or a consent-screen change, so it lands on a random Tuesday with no correlated commit.

Synthetic monitoring incumbents can technically catch this, but they hand you a scripting environment and make OAuth, with its 2FA challenges and bot detection, your problem. The wedge is prebuilt, centrally maintained flows for Google, GitHub, Slack and Microsoft: when the provider changes its screens, the vendor fixes one script and the whole customer base stays covered.

Who pays

The buyer is a SaaS team whose signup and login run through social OAuth, which is most B2B SaaS; the person who feels it is whoever owns activation numbers. At 29 to 99 dollars a month it prices as outage insurance for the single highest-value flow in the product. Distribution: SEO on sign in with google stopped working, war-story content, and indie SaaS communities where a founder posting our signups were dead for four days is recurring free marketing.

MVP scope

• Prebuilt maintained Google OAuth flow with customer-supplied test account and TOTP handling
• Daily headless runs with success assertions against the customer’s app
• Step-by-step screenshots and video on failure, one automatic retry to kill flakes
• Slack, email and SMS alerting
• Dashboard with run history, duration trends and incident detail
• Skip for v1: GitHub/Slack/Microsoft providers (fast follows), email/password and magic-link flows, per-customer custom scripting, region-distributed probes, status page hosting

Build LoginCanary, a synthetic monitoring service for OAuth sign-in flows. Stack: Playwright workers, Next.js dashboard, Postgres for state and run history, Stripe for billing.

Core flow: user registers their app's login URL and picks providers to monitor, starting with Sign in with Google. They supply a dedicated Google test account (email plus password stored encrypted, TOTP secret for 2FA, stored so the worker can generate codes). LoginCanary ships prebuilt, centrally maintained Playwright flows per provider: navigate to the customer's login page, click the Google button (found via role/aria heuristics with an optional CSS override in settings), complete the real Google login including TOTP, then assert success by checking the user lands on a customer-specified URL pattern or that a customer-specified selector appears.

Runs execute daily by default, up to hourly on the top tier, from a stable IP range documented so customers can allowlist it. On failure: capture a full-page screenshot and video at each step, retry once to filter transient flakes, then alert via Slack webhook, email, and SMS (Twilio) because a dead signup flow at 2am deserves a page. When Google changes its consent screens, we fix the shared flow once and every customer is covered, which is the entire point versus scripting it themselves.

Pages: landing leading with the dashboards-say-up-but-signups-are-dead scenario, setup wizard with a live first run, monitors dashboard with per-provider status and duration trend, incident detail with screenshot timeline, billing.

Pricing: 29 GBP/month one provider daily; 99 GBP/month four providers hourly plus SMS.