AuthOS

The open-source, multi-tenant authentication platform for B2B2C applications.

AuthOS provides a production-grade identity infrastructure with a focus on performance, security, and developer experience. Built with a high-performance Rust backend and comprehensive TypeScript SDKs, it handles complex authentication flows so you don't have to.

Repository Structure

This public repository contains the core backend API and the ecosystem of client libraries. Proprietary dashboard and internal operations tooling are not included here.

Path	Package	Description
api/	Core Backend	High-performance Rust (Axum) API handling auth, users, and organizations.
sso-sdk/	@drmhse/sso-sdk	Zero-dependency, framework-agnostic TypeScript client.
packages/authos-react/	@drmhse/authos-react	React & Next.js adapters with hooks, components, and middleware.
packages/authos-vue/	@drmhse/authos-vue	Vue 3 & Nuxt adapters with composables and components.
packages/authos-node/	@drmhse/authos-node	Node.js server adapter (Express middleware, webhook verification).
packages/authos-cli/	@drmhse/authos-cli	CLI tool for scaffolding AuthOS components into your app.

AI Agent Skills

Source-verified Agent Skills for AuthOS are available at github.com/drmhse/authos_skill. They are designed for AI coding agents that need to implement, integrate, deploy, or operate AuthOS using the public API, SDK, package, and docs surfaces.

See the install guide at authos.dev/docs/ai-agent-skills/.

Key Features

• Multi-Tenant Architecture: Built from the ground up for B2B applications. Users belong to organizations with specific roles and permissions.
• Authentication Methods:
  • Email/Password (Argon2 hashing)
  • OAuth2 / Social Login (GitHub, Google, Microsoft)
  • Passkeys (WebAuthn/FIDO2)
  • Magic Links (Passwordless)
  • Enterprise SSO / OIDC (Bring Your Own Auth)
• Security:
  • MFA: TOTP (Authenticator apps) and Backup Codes.
  • Risk Engine: Adaptive authentication based on IP velocity, impossible travel, and device fingerprinting.
  • Device Trust: Management and revocation of user devices.
• Integration:
  • Billing: Native support for Stripe and Polar.
  • SCIM 2.0: Automated user provisioning from external IdPs.
  • SIEM Streaming: Stream audit logs to Datadog, Splunk, Elastic, or S3.
  • Webhooks: Event-driven architecture with signed payloads.

Getting Started

1. Run the Backend API

The core of AuthOS is the Rust API. You need Rust (1.89+) installed.

cd api

# 1. Setup environment
cp .env.example .env
# Edit .env to add your database URL and generated keys

# 2. Run the server
cargo run --release

With the example environment, the API starts at http://localhost:3001.

Run a Published Docker Image

The backend API is also published as public Docker images:

Backend	Image
SQLite default	editoredit/sso:latest or editoredit/sso:sqlite-latest
PostgreSQL	editoredit/sso:psql-latest
MySQL	editoredit/sso:mysql-latest

The repository includes Compose examples under api/:

cd api
cp .env.example .env
docker compose -f docker-compose.sqlite.yml up

For version-pinned deployments, use the matching <backend>-<version> tags such as editoredit/sso:sqlite-0.1.39.

2. Integrate the Frontend

You can scaffold a new integration using the CLI, or install specific packages manually.

Using the CLI (Recommended)

# Initialize AuthOS in your React/Vue/Next.js/Nuxt project root
npx @drmhse/authos-cli init

# Add pre-built components (Login Form, User Profile, etc.)
npx @drmhse/authos-cli add login-form
npx @drmhse/authos-cli add user-profile

Manual Installation

React / Next.js:

npm install @drmhse/authos-react

import { AuthOSProvider } from '@drmhse/authos-react';

export default function App() {
  return (
    <AuthOSProvider config={{ baseURL: 'http://localhost:3001' }}>
      <YourApp />
    </AuthOSProvider>
  );
}

Vue / Nuxt:

npm install @drmhse/authos-vue

Node.js / Express:

npm install @drmhse/authos-node

Development Workflow

Prerequisites

• Rust: v1.89+
• Node.js: v18+
• Database: SQLite (default), PostgreSQL, or MySQL.

Building Packages

To build the SDK and all adapter packages:

# In the root directory
npm install
npm run build

This uses tsup to build distributable bundles for all packages in packages/ and sso-sdk/.

To build only one surface:

npm run build:sdk
npm run build:packages

To check the Rust API:

cd api
cargo check

Security

• Tokens: Uses short-lived JWTs (RS256) and rotating Refresh Tokens.
• Storage: Client SDKs manage token persistence securely (Cookies for SSR, LocalStorage/Memory for SPA).
• Encryption: Sensitive data (OAuth secrets, SMTP credentials) is encrypted at rest (AES-GCM).

License

AuthOS is multi-licensed by repository area:

• API: AGPL-3.0-only
• SDKs & Packages: MIT
• Vendored SQLx MySQL patch: MIT OR Apache-2.0, with license texts in api/vendor/sqlx-mysql/

See LICENSE for the complete licensing map.