Self-hosted identity infrastructure
One identity server. Every product you ship.
OAuth2 and OpenID Connect, built on ory/fosite and conformance-tested against the OpenID Foundation suite. Passkeys, MFA, per-tenant branding, and a full audit trail — deployed to your own infrastructure, with your users in your own database.
RFC-compliant
OAuth2 and OIDC on ory/fosite
Conformance-tested
OpenID Foundation suite
Self-hosted
Runs in your own infrastructure
Single binary
Server + worker, containerised
Features
Twenty-one things you would otherwise build yourself.
Authentication
OAuth2 & OpenID Connect
Authorization code with PKCE (S256) required on every exchange, refresh tokens, and client credentials. No implicit grant.
Passkeys & WebAuthn
Discoverable, usernameless assertions backed by hardware credentials — no password anywhere in the flow.
TOTP and step-up
Authenticator codes with recovery codes, plus a re-assertion prompt in front of the actions that warrant one.
Magic links and social login
Single-use, short-expiry email links, with Google, GitHub, and Microsoft as first-class providers.
Automatic key rotation
RS256 signing keys rotate on a schedule. Retired keys stay published in JWKS long enough for tokens already issued to verify.
Multi-tenancy and branding
Per-tenant theming
Organization and client branding resolved per request and injected into the sign-in surface — no rebuild, no redeploy.
Custom domains
Tenants sign in on their own hostname, verified by CNAME, with certificates issued on demand and shared across replicas.
Organization console
Members, roles, invitations, applications, and settings — a console you hand to the tenant instead of operating on their behalf.
Bring your own OAuth apps
An organization can put its own Google, GitHub, or Microsoft credentials behind social sign-in, so the consent screen carries its name.
CSV user migration
Bulk-import existing accounts from another provider, invitation-based, so moving does not mean a password reset for everyone.
Governance and audit
Role-based access control
Platform and organization roles assigned per membership, so the same person can own one organization and be a member of another.
Permission engine
Roles resolve to explicit permissions, and each console route is gated by the permission it needs rather than by a role name.
Audit log
An append-only record of who did what, to whom, and when — written from the same domain events the application already emits.
Session controls
Short sessions with silent refresh and an absolute ceiling, plus a list of live sessions a user or an admin can revoke.
Platform-admin console
Signing keys, email delivery, custom domains, and organizations in one console, gated by platform permissions.
Built to run anywhere
Go binaries, distroless images
Server, worker, and migrator compile to static binaries and ship in distroless images with a read-only root filesystem.
Kubernetes-native
A Helm chart with server, worker, and a pre-install migration job. Nothing bespoke to run it under ArgoCD.
Postgres and Redis
The entire required dependency list. Schema changes are versioned migrations run as their own job, never by the server at boot.
Redis rate limiting
Per-IP limits on the public endpoints, shared across replicas, failing open on a Redis blip rather than locking anyone out.
HMAC-signed webhooks
Per-client signing secrets and bounded retries — six attempts backing off over roughly nineteen hours.
Kafka events, both directions
Six topics published from a transactional outbox, so a message is queued in the same transaction as the change it describes, and one inbound topic another service can use to have somebody invited.
Security
Security is the product, not a feature.
No dev-auth stubs and no fake-auth paths. Every module ships its security requirements as named tests rather than as documentation.
argon2id everywhere
Password verification uses argon2id with OWASP-aligned parameters — the same ones locally and in production.
Envelope-encrypted keys
RSA signing keys are AES-256-GCM encrypted at rest under a master key, and retired keys are never deleted.
Soft-delete only
The application role is granted SELECT, INSERT, and UPDATE. DELETE is withheld at the database, not in code.
Inside the console
Built for the people who operate it.
Run it on your own infrastructure.
Tell us the shape of your deployment and we will get you a build and the Helm chart.