Authentication without bloat, lock-in, or complexity.
Authes.org is a high-performance OpenID Connect & OAuth 2.0 engine built for the open web. Single-binary Go architecture, zero database dependencies, native multi-tenancy, Dynamic Client Registration (DCR), and cutting-edge Client ID Metadata Documents (CIMD).
Engineered for absolute developer freedom and user privacy.
100% Free & Open Source
No hidden enterprise tier, no per-user licensing fees, and zero proprietary tracking. Host your own auth sovereignty or rely on standard federated infrastructure with complete code transparency on Codeberg.
True Multi-Tenancy
Isolate multiple organizations, applications, or staging environments on one server. Each tenant receives a dedicated storage folder (/data/{slug}/), independent users, clients, custom issuer URLs, and bespoke templates.
Zero Database Bloat
No PostgreSQL, MySQL, or Redis cluster needed. Authes persists tenant configurations and users via clean flat-file YAML data with atomic writes and fast in-memory indexing. Backups are as simple as copying a directory.
Dynamic Registration (DCR)
Adheres strictly to RFC 7591. Web sites, microservices, and native apps can dynamically register OAuth 2.0 clients without manual administrator intervention, expediting automated deployment pipelines.
Client ID Metadata (CIMD)
Support for next-generation decentralized OAuth (draft-ietf-oauth-client-id-metadata-document). Clients use an HTTPS URL as their client_id. Authes dynamically fetches metadata and verifies redirect URIs on demand.
Human-Centric Usernames
Privacy-first registration assigns memorable, non-ambiguous usernames (avoiding confusing characters like 0 or O). Email and telephone numbers remain optional, making identity secure and human-friendly.
Simple documentation for modern authentication workflows.
Zero-Registration Client ID Documents (CIMD)
Client ID Metadata Documents (CIMD) eliminate the traditional pain of manually creating OAuth clients, managing client secrets, and dealing with credential leakage.
-
The Client ID is a URL: The client supplies its HTTPS URL (e.g.
https://myapp.com/oauth-client.json) as theclient_id. -
Automated Verification: Authes fetches the JSON document over TLS, validates allowed
redirect_uris, caches the result, and authorizes requests without stored secrets. - Configurable per Tenant: Toggle CIMD on or off in the Tenant settings panel or API whenever needed.
Reference specification: draft-ietf-oauth-client-id-metadata-document
{
"client_id": "https://myapp.com/oauth-client.json",
"client_name": "My Sovereign Web App",
"client_uri": "https://myapp.com",
"redirect_uris": [
"https://myapp.com/callback",
"https://myapp.com/auth/response"
],
"response_types": ["code"],
"grant_types": ["authorization_code", "refresh_token"],
"token_endpoint_auth_method": "none"
}
https://authes.org/oauth/authorize? response_type=code &client_id=https%3A%2F%2Fmyapp.com%2Foauth-client.json &redirect_uri=https%3A%2F%2Fmyapp.com%2Fcallback &scope=openid%20profile%20email
Dynamic Client Registration (RFC 7591)
Dynamic Client Registration (DCR) allows third-party services and client applications to register themselves on demand by sending a simple JSON request to the tenant registration endpoint.
- Programmatic Client Provisioning: Integrate seamlessly into automated CI/CD and developer onboarding flows.
-
Immediate Credentials: Returns standard OAuth
client_idandclient_secretinstantly with specified redirect URIs. -
Standard Discovery: Advertised at
registration_endpointin/.well-known/openid-configuration.
curl -X POST https://authes.org/register \
-H "Content-Type: application/json" \
-d '{
"client_name": "My Mobile Application",
"redirect_uris": ["https://myapp.com/oauth/callback"],
"grant_types": ["authorization_code", "refresh_token"],
"response_types": ["code"]
}'
{
"client_id": "c_9f83a2...",
"client_secret": "s_e4b10c...",
"client_name": "My Mobile Application",
"redirect_uris": ["https://myapp.com/oauth/callback"],
"client_id_issued_at": 1741584000
}
Multi-Tenancy & Tenant Creation
Authes is architected from the ground up for multi-tenancy. You can create and manage unlimited isolated auth realms with their own configurations and users.
-
Dedicated Endpoints: Reachable via
/{slug}/oauth/authorizeand/{slug}/.well-known/openid-configuration. - Web UI & REST API: Provision tenants effortlessly via the /admin dashboard or script them with HTTP requests.
-
Isolated Storage: Each tenant is stored in
/data/{slug}/tenant.yaml, allowing instant migrations and snapshot rollbacks.
curl -X POST https://authes.org/admin/api/tenants \
-H "Content-Type: application/json" \
-H "Cookie: authes_session=YOUR_ADMIN_SESSION_TOKEN" \
-d '{
"id": "acme-corp",
"name": "Acme Corporation",
"description": "Enterprise customer tenant",
"dcr_enabled": true,
"cimd_enabled": true,
"use_username": true
}'
/data/
default/
tenant.yaml
acme-corp/
tenant.yaml # Configuration & Clients
users.db # Tenant user database
templates/ # Customized HTML templates
Deploy Your Server with Docker Compose
Running Authes on your own infrastructure takes less than 30 seconds. A single container image contains everything required—no external databases, daemons, or runtime dependencies.
-
Persistent Data Volume: Mount
./datato/app/datato persist all tenant configurations and credentials. - Runtime Config via Env: Configure ports, data directory, and customize the adjective/noun dictionaries for username generation.
- Minimal Resource Footprint: Runs smoothly on tiny $3/month VPS instances with < 20MB of RAM.
version: '3.8'
services:
authes:
image: authes/authes:latest
container_name: authes
restart: unless-stopped
ports:
- "8080:8080"
volumes:
- ./data:/app/data
environment:
- PORT=8080
- DATA_DIR=/app/data
# Optional: Extend suggested username dictionaries
- AUTHES_SHORT_ADJECTIVES=swift,bold,calm,keen,zen
- AUTHES_SHORT_NOUNS=fox,oak,wave,peak,lynx
Standard compliance with RFC 6749 & OIDC Core 1.0.
Connect any standard OpenID Connect client library (Passport.js, Go coreos/go-oidc, Python authlib, NextAuth.js) using the auto-discovery endpoints below: