Auth infrastructure
you actually own
A complete authentication platform for your web and mobile apps. Replace Auth0 or Clerk with a self-hosted solution that gives you full data ownership and no per-user fees — ever.
Everything you need
Production-ready features included out of the box — no paid tiers.
Authentication Methods
- ✓Email + Password— Argon2id hashed, strength-enforced
- ✓Magic Link (passwordless)— One-click sign-in via email
- ✓TOTP 2FA— Google Authenticator / Authy compatible, with backup codes
- ✓Social Login— Google, GitHub, Microsoft via OAuth2
- ✓Enterprise SSO— OIDC federation with Azure Entra ID (JIT provisioning, group→role mapping)
- ✓API Keys (M2M)— Machine-to-machine authentication with scoped keys
Security
- ✓Rate limiting— Sliding-window per email+IP, backed by Redis
- ✓Login lockout— Configurable per-app max attempts and lockout duration
- ✓IP allowlist / denylist— CIDR-based access control per application
- ✓New device alerts— Email notification on first login from unknown device/IP
- ✓Inactivity lock— Auto-deactivate users inactive for configurable days
- ✓Global & per-app lock— Admin can lock any account instantly
Standards & Protocols
- ✓OIDC / OAuth 2.0— Authorization Code Flow, PKCE enforcement for public clients
- ✓Token introspection— RFC 7662 — resource servers validate tokens without the signing secret
- ✓Signed logout— OIDC end_session_endpoint (id_token_hint, post_logout_redirect_uri)
- ✓Refresh tokens— Long-lived sessions with configurable expiry
- ✓Webhooks— Signed POST on user.login, user.register, user.login_failed, and more
Admin & Multi-Tenancy
- ✓Multi-application— Unlimited applications with isolated configs, themes, and users
- ✓Per-app branding— Custom logo, colors, and button style per login page
- ✓Role-based access— Define per-app roles; assign via admin or group mapping
- ✓Approval workflows— Require admin approval before new users can sign in
- ✓Audit log— Every auth event logged with IP, user agent, and timestamp. CSV export.
- ✓Impersonation— Admin can act as any user for support purposes (logged)
Self-Service
- ✓Profile management— Name and email change with verification flow
- ✓Password management— Forgot password, reset, and change flows
- ✓Session management— View and revoke active sessions
- ✓2FA self-service— Enroll, disable, and regenerate backup codes
- ✓Invite-only registration— Users invite others with one-time tokens
vs Auth0 & Clerk
Enterprise-grade features without the enterprise pricing.
| Feature | Identity Service | Auth0 | Clerk |
|---|---|---|---|
| Open source & self-hosted | ✓ | ✗ | ✗ |
| No per-MAU pricing | ✓ | ✗ | ✗ |
| Unlimited applications | ✓ | 2 (free) | 1 (free) |
| Email + Password | ✓ | ✓ | ✓ |
| Magic Link | ✓ | ✓ | ✓ |
| TOTP 2FA + backup codes | ✓ | paid | ✓ |
| Enterprise SSO (Azure Entra) | ✓ | paid | paid |
| PKCE for public clients | ✓ | ✓ | partial |
| Token introspection (RFC 7662) | ✓ | ✓ | ✗ |
| IP allowlist / denylist | ✓ | paid | ✗ |
| New device email alerts | ✓ | ✗ | ✗ |
| Per-app branding | ✓ | paid | ✓ |
| Webhooks | ✓ | paid | ✓ |
| Audit log + CSV export | ✓ | paid | paid |
| Custom fields | ✓ | ✓ | ✓ |
| Full data ownership | ✓ | ✗ | ✗ |
Comparison based on publicly available pricing pages as of 2026. "paid" = feature requires a paid plan.
Security posture
Built for security from day one — not bolted on afterwards.
No secrets at rest
Passwords are hashed with Argon2id. Backup codes are SHA-256 hashed. No plaintext credentials stored anywhere.
Short-lived tokens
Authorization codes expire in 5 minutes. Access tokens are signed JWTs. Refresh tokens are stored as opaque hashes.
Brute-force protection
Redis-backed sliding-window rate limiter + per-app configurable lockout after N failed attempts.
Network access control
CIDR-based IP allowlist and denylist enforced at login — before credentials are even checked.
PKCE for SPAs
Public clients can require PKCE (RFC 7636), preventing auth code interception attacks without client secrets.
Full audit trail
Every authentication event is logged with event type, IP address, user agent, and timestamp. Exportable to CSV.
New device alerts
Users receive an immediate email when a login occurs from a previously unseen device or IP address.
Account controls
Admins can lock any user globally, per-app, or for inactivity. Impersonation is logged. Approval workflows available.
Self-hosted = you control TLS
Your infrastructure. Your TLS certificates. No third-party intermediary touches your users' credentials.
Pricing
Simple and transparent. No per-seat or per-MAU surprises.
Run on your own infrastructure. Full source access. All features included.
- ✓ Unlimited apps
- ✓ Unlimited users
- ✓ All features
- ✓ Community support
- ✓ You run the infra
We run it for you on dedicated infrastructure. SLA, backups, and updates included.
- ✓ Unlimited apps
- ✓ Unlimited users
- ✓ All features
- ✓ Dedicated instance
- ✓ SLA + backups
- ✓ Priority support
Custom deployment, white-label, SAML 2.0, SCIM provisioning, and professional services.
- ✓ Everything in Managed
- ✓ SAML 2.0 (roadmap)
- ✓ SCIM provisioning (roadmap)
- ✓ White-label
- ✓ Custom SLA
- ✓ Professional services
Integrate in minutes
Standard OIDC Authorization Code Flow — works with any framework.
1. Redirect to login
const loginUrl = new URL(
'https://auth.svc.jxs.se/login/your-app'
)
loginUrl.searchParams.set('redirect_uri', CALLBACK_URL)
loginUrl.searchParams.set('state', csrfToken)
// Optional: add code_challenge for PKCE
redirect(loginUrl.toString())2. Exchange code for tokens
const res = await fetch(
'https://auth.svc.jxs.se/api/auth/token',
{
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
code,
client_id: CLIENT_ID,
client_secret: CLIENT_SECRET,
}),
}
)
const { access_token, id_token } = await res.json()3. Fetch user profile
const profile = await fetch(
'https://auth.svc.jxs.se/api/auth/userinfo',
{ headers: { Authorization: `Bearer ${access_token}` } }
).then(r => r.json())
// { sub, email, name, ... }Full Next.js example
test-app repository.Ready to own your auth?
Start with the open-source self-hosted version for free. Upgrade to managed hosting when you want us to run it for you.