OAuth2 & OpenID Connect
Authorization code with PKCE (S256) required on every exchange, refresh tokens, and client credentials. No implicit grant.
Self-hosted identity infrastructure
One identity server for every Nuvraxis product.
OAuth2 and OpenID Connect, built on ory/fosite and conformance-tested against the OpenID Foundation suite. Passkeys, MFA, per-tenant branding, and a full audit trail — running as one binary you operate yourself.
RFC-compliant
OAuth2 and OIDC on ory/fosite
Conformance-tested
OpenID Foundation suite
Self-hosted
Runs in your own cluster
Single binary
Server + worker, containerised
Features
Every product at Nuvraxis authenticates against the same server, the same way.
Passkeys & WebAuthn
Discoverable, usernameless assertions backed by hardware credentials — no password in the flow at all.
Multi-factor authentication
TOTP with recovery codes, enforced as a pending-MFA session that cannot reach an authenticated route.
Magic links & social login
Single-use, short-expiry email links, plus Google, GitHub, and Microsoft as first-class providers.
Per-tenant theming
Organization and client branding resolved per request and injected into the sign-in surface — no rebuild.
Custom domains
Tenants bring their own sign-in hostname; certificates are issued on demand and shared across replicas.
Client webhooks
HMAC-signed delivery with bounded retries — six attempts backing off over roughly nineteen hours.
RBAC & audit log
Real roles and permissions, with a queryable trail of who did what, to whom, and when.
User migration
Bulk CSV import of existing accounts, so moving from another provider does not mean a password reset for everyone.
Kubernetes-native
A Helm chart with server, worker, and a pre-install migration job. Distroless images, read-only root filesystem.
Security
Security is the product, not a feature.
No dev-auth stubs and no fake-auth paths. Every module ships its security requirements as named tests rather than as documentation.
argon2id everywhere
Password verification uses argon2id with OWASP-aligned parameters — the same ones locally and in production.
Envelope-encrypted keys
RSA signing keys are AES-256-GCM encrypted at rest under a master key, and retired keys are never deleted.
Soft-delete only
The application role is granted SELECT, INSERT, and UPDATE. DELETE is withheld at the database, not in code.
Inside the console