AuthoraIdentity. Access. Control.

A lightweight, self-hosted identity and access management server for small projects and applications. Your applications let users sign in through Authora instead of each building their own authentication.

Get started

Documentation

View on GitHub

🔐

OAuth 2.1 and OpenID Connect

Authorization Code flow with mandatory PKCE, rotating Refresh Tokens with reuse detection, ID Tokens, UserInfo, discovery, revocation and introspection.

Supported standards

👤

Users, Groups and Roles

Manage who may administer Authora, with fine-grained Permissions.

The access model

🔑

Applications

Connect an application

🖥️

Admin interface

A browser interface at /admin with a backend for frontend, so tokens never reach the browser.

How it works

📜

Tamper-evident audit log

Sign-ins and every administrative change, sealed into a hash chain you can verify.

Audit log integrity

🛡️

Secure by default

Opaque Access Tokens that are revoked instantly, only hashes stored, strict headers and cookies, and refusal to start with an insecure configuration.

Security model

Run it in minutes

One container and one PostgreSQL database. With Docker and OpenSSL:

git clone https://github.com/DuttonAlan/Authora.git && cd Authora

mkdir -p secrets
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out secrets/signing-key.pem
openssl req -x509 -newkey rsa:2048 -nodes -days 365 -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" -keyout secrets/tls.key -out secrets/tls.crt
chmod 644 secrets/*

cp .env.example .env    # then set POSTGRES_PASSWORD and AUTHORA_ADMIN_PASSWORD
docker compose up --build

Open https://localhost:8443/admin/, accept the self-signed certificate, and sign in with the administrator from .env. The Getting started tutorial walks through these steps.

For production, use the published images ghcr.io/duttonalan/authora and ghcr.io/duttonalan/authora-migrator, see Deploy to production.

Project status: early

Authora is young and has not had an independent security audit. Try it, build on it, report what you find, but weigh that before you protect production data with it. See the security model and what is not supported yet.