Appearance
Introduction
Authara is a self-hosted identity provider (OpenID Connect + OAuth 2.1) designed to be the single authentication service behind multiple products. One deployment serves many products and tenants, each fully isolated and independently branded.
Why Authara
- Standards-based. A compliant OIDC / OAuth 2.1 issuer with PKCE, refresh-token rotation, JWKS, and a discovery endpoint. Any standards-compliant client works.
- Multi-tenant by design. Each tenant gets its own Postgres role + row-level security, its own OIDC issuer, and its own scoped Management API. Data isolation is enforced at the database, not in app code.
- Per-application branding. Logo, colors, and background can be set per application and override the tenant/root defaults on the sign-in screen.
- Batteries included. Sign-in experience, MFA (TOTP / WebAuthn / backup codes), social & enterprise SSO connectors, organizations, roles & permissions (RBAC), webhooks, audit logs, and a full admin console.
Architecture at a glance
| Piece | What it is |
|---|---|
| Core | The runnable server (Koa + oidc-provider). Serves the OIDC issuer + end-user sign-in experience and the admin console. |
| Console | The admin console: applications, connectors, sign-in experience, users, roles, organizations, webhooks, SSO, audit logs, and branding. |
| Experience | The end-user sign-in / sign-up UI. |
| Schemas | Shared types, database schema, and row-level-security definitions. |
| CLI | Database seeding, migrations, and connector management. |
| Connectors | Social / email / SMS / enterprise-SSO connectors. |
Two hosts
Authara exposes two surfaces:
- Issuer + sign-in experience (
ENDPOINT) — the OIDC endpoints (/oidc/*) and the sign-in UI your users see. - Admin console (
ADMIN_ENDPOINT) — the console SPA and the per-tenant Management API.
Where to next
- Deploy & run Authara.
- Connect an application and sign users in.
- Understand sessions & tokens.
- Set up multi-tenancy to serve many products from one install.