Your app redirects to EliteSSO with an OIDC authorization request; EliteSSO authenticates the user (magic-link email, no password) and redirects back with a signed token your app verifies.
Enterprise customers connect their own identity provider over SAML; SCIM keeps user provisioning and de-provisioning in sync automatically.
Beyond the free tier, EliteSSO is billed per monthly-active-user rather than per named seat.