ThunderID is a lightweight, open-source IAM stack built to secure access for humans, AI agents, and machines.
Designed for the agentic era, ThunderID provides a developer-first IAM stack and supporting tools for securing applications, APIs, services, and agent-driven workflows. It works across traditional and decentralized identity ecosystems, with post-quantum-ready security built in from the start.
Core design goals of ThunderID include:
- Agent-native identity: Manage AI agents as first-class identities with delegated authority, consent-aware access, traceability, and support for issuing verifiable credentials to agents. ThunderID also aims to expose IAM capabilities through interfaces that agents can use safely and programmatically.
- Post-quantum-safe by design: Build on a crypto-agile foundation where algorithms, key types, signing methods, and token protection mechanisms can evolve over time, including support for post-quantum-safe algorithms and hybrid transition approaches across key management, credential issuance, assertions, and secure service-to-service communication.
- Decentralized identity: Bridge the adoption gap for relying parties by making it practical for service providers to consume, verify, and trust decentralized identity in real-world applications, including DIDs, verifiable credentials, digital wallets, trust registries, and issuer-verifier-holder interaction models.
- Lightweight runtime with GitOps support: Provide a lightweight, containerized runtime that can run across on-premises and cloud environments, with declarative identity flows, policies, and configuration suitable for automation, versioning, and GitOps practices.
Getting Started
Get started by exploring how ThunderID can be used to secure:
- Applications - by following Securing B2C Application Guide
- AI Agents - by following Securing AI Agents Guide
- MCP - by following Securing MCP Guide
To learn more about overall requirements, solution patterns of these scenarios, refer to the Use Cases section.
Visit Get ThunderID to learn more about installation methods.
What's Changed
✨ Improvements
- Add support to fail flow on consent denial by @ThaminduDilshan in #5040
- improved thunderidengine with cors configuration by @sacrana0 in #5049
- added handling of direct jwt response from authnprovider by @sacrana0 in #5085
- Provide flexibility to extend allowed oauth configs via pluggable engine by @ThaminduDilshan in #5099
🐛 Bug Fixes
- Advertise token_endpoint_auth_signing_alg_values_supported in discovery by @KashiwalHarsh in #5023
- Added ui_locales support. by @SajidMannikeri17 in #5022
- [Backport] Sync the CLI tools tree on 1.0.x with the published 1.0.2 release by @brionmario in #5087
- Fix flow text resolution in UserAddPage and UserCreatePage by @NipuniBhagya in #5079
- [main -> 1.0.x] Backport OAuth fixes by @thiva-k in #5119
- Apply the configured log format to every log record by @UdeshAthukorala in #5129
- Fixed the JWKS kid and alg mismatch issue by @anushasunkada in #5135
- [1.0.x] Pick the tool release bump and npm dist-tag from the release branch by @brionmario in #5092
Full Changelog: v1.0.0...v1.0.1
License
Licenses this source under the Apache License, Version 2.0 (LICENSE), You may not use this file except in compliance with the License.
