A production-ready OAuth 2.1 + OpenID Connect 1.0 authorization server built with FastAPI and PostgreSQL. Authly provides enterprise-grade security, comprehensive testing (439/439 tests passing), and professional administration tools.
✅ Complete OAuth 2.1 + OIDC 1.0 Compliance - Full RFC implementation with PKCE
✅ 500+ Tests Passing - 100% success rate with real integration testing
✅ Enterprise Security - Two-layer admin system, rate limiting, audit logging
✅ Production Architecture - Docker, monitoring, health checks, deployment guides
✅ Professional CLI - Complete admin interface with API-first architecture
✅ Developer Experience - Comprehensive docs, easy setup, embedded development mode
- Authorization Code Flow with mandatory PKCE (Proof Key for Code Exchange)
- Client Management for confidential and public OAuth clients
- Token Revocation (RFC 7009) for immediate token invalidation
- Server Discovery (RFC 8414) for automatic client configuration
- Scope Management with granular permission control
- Authorization Code Grant with PKCE for third-party applications
- Password Grant for trusted first-party applications
- Refresh Token Grant for token renewal
- Client Credentials Grant for service-to-service authentication
- RFC 6749 - OAuth 2.0 Authorization Framework ✅
- RFC 7636 - Proof Key for Code Exchange (PKCE) ✅
- RFC 7009 - OAuth 2.0 Token Revocation ✅
- RFC 8414 - OAuth 2.0 Authorization Server Metadata ✅
- ID Token Generation with RS256/HS256 signing algorithms
- UserInfo Endpoint with scope-based claims filtering
- JWKS Endpoint for token signature verification
- OIDC Discovery with provider configuration metadata
- Standard Claims - sub, aud, iss, exp, iat, auth_time, nonce
- Profile Claims - name, given_name, family_name, email, email_verified
- Custom Claims - Extensible claims processing based on requested scopes
- OpenID Connect Core 1.0 - Complete implementation ✅
- OpenID Connect Discovery 1.0 - Provider metadata ✅
- JWT Security - RS256/HS256 signing with proper validation and rotation
- Password Security - bcrypt hashing with configurable work factors
- Token Management - JTI tracking, rotation, and blacklisting
- Session Security - Concurrent session control and timeout management
- Two-Layer Security - Intrinsic authority (is_admin flag) + OAuth scopes
- Bootstrap System - Solves IAM chicken-and-egg paradox
- Granular Permissions - 8 admin scopes for fine-grained access control
- API Restrictions - Admin API localhost-only with configurable access
- Rate Limiting - Configurable protection with multiple backends
- CORS Protection - Comprehensive CORS policies and security headers
- Secret Management - Encrypted storage with automatic memory cleanup
- Audit Logging - Complete administrative action tracking
- Registration & Verification - Complete user onboarding with email verification
- Role-Based Access Control - Admin and user roles with privilege management
- Profile Management - Comprehensive user profile CRUD operations
- Account Security - Password reset, account lockout, and security monitoring
- User Administration - Create, update, delete, and manage user accounts
- Permission Management - Assign and revoke admin privileges
- Security Monitoring - Track user authentication and security events
# Start Authly server
python -m authly serve
# Admin operations
python -m authly admin login
python -m authly admin client create --name "My App" --type public
python -m authly admin scope create --name read --description "Read access"
python -m authly admin status- Authentication -
login,logout,whoamiwith secure token storage - Client Management - Create, list, update, delete OAuth clients
- Scope Management - Create, list, update, delete OAuth scopes
- User Management - Admin user operations and privilege management
- System Status - Health checks, configuration, and system information
- HTTP API Backend - CLI uses REST API exclusively (no direct DB access)
- Secure Authentication - JWT-based admin authentication with refresh tokens
- Consistent Interface - All admin operations available via both CLI and API
# Clone and install
git clone <repository-url>
cd authly
uv sync --all-groups -U
# Start with embedded development server (includes PostgreSQL container)
uv run python -m authly serve --embedded --dev
# Access Authly at http://localhost:8000
# Admin CLI: uv run python -m authly admin --help# Using Docker
docker build -t authly .
docker run -p 8000:8000 \
-e DATABASE_URL="postgresql://user:pass@host:5432/authly" \
-e JWT_SECRET_KEY="your-secret-key" \
authly
# Using UV
export DATABASE_URL="postgresql://user:pass@localhost:5432/authly"
export JWT_SECRET_KEY="your-secret-key"
uv run python -m authly serve# Create OAuth client
uv run python -m authly admin login
uv run python -m authly admin client create \
--name "My Application" \
--type confidential \
--redirect-uri "https://myapp.com/callback"
# Create scope
uv run python -m authly admin scope create \
--name "read" \
--description "Read access to user data"- API Reference - Complete REST API documentation
- OAuth 2.1 Guide - OAuth implementation and usage
- OIDC Guide - OpenID Connect implementation and usage
- CLI Guide - Complete CLI administration guide
- Deployment Guide - Production deployment instructions
- Security Guide - Security features and best practices
- Development Guide - Setup and development workflows
- Testing Guide - Testing architecture and patterns
- Architecture Guide - System design and patterns
GET/POST /oauth/authorize- Authorization endpoint with consent UIPOST /oauth/token- Token exchange endpoint with all grant typesPOST /oauth/revoke- Token revocation endpointGET /.well-known/oauth-authorization-server- OAuth discovery metadata
GET /oidc/userinfo- UserInfo endpoint with claims filteringGET /.well-known/jwks.json- JWKS endpoint for token verificationGET /.well-known/openid_configuration- OIDC discovery metadata
POST /auth/token- User authentication and token generationPOST /auth/refresh- Token refresh and rotationPOST /auth/logout- Token invalidation and logout
GET/POST /admin/clients- OAuth client managementGET/POST /admin/scopes- OAuth scope managementGET/POST /admin/users- User management (admin only)GET /admin/status- System health and configuration
GET /health- Application health checkGET /health/ready- Readiness probe for KubernetesGET /health/live- Liveness probe for Kubernetes
- 500+ Tests Total - 100% passing (verified production quality)
- Real Integration Testing - PostgreSQL testcontainers (no mocking)
- Complete Flow Testing - End-to-end OAuth and OIDC flows
- Security Testing - Authentication, authorization, and validation
- API Testing - All endpoints with comprehensive scenarios
- OAuth 2.1 Tests (156 tests) - Authorization flows, PKCE, client management
- OIDC 1.0 Tests (98 tests) - ID tokens, UserInfo, JWKS, discovery
- Admin System Tests (85 tests) - CLI, API, security, authentication
- Core Authentication Tests (67 tests) - JWT, passwords, tokens
- User Management Tests (33 tests) - User lifecycle and management
- No Mocking - Real database and HTTP server integration testing
- Comprehensive Coverage - All features, security scenarios, and error cases
- Continuous Validation - 100% success rate maintained throughout development
- Python 3.11+ - Modern async/await with comprehensive type annotations
- FastAPI - High-performance async web framework with automatic OpenAPI
- PostgreSQL - Advanced database with UUID primary keys and proper indexing
- Pydantic v2 - Modern data validation with constraints and serialization
- UV - Modern, fast Python package manager and dependency resolver
- Package-by-Feature - Clean module organization with clear boundaries
- Repository Pattern - Clean data access layer with async operations
- Service Layer Pattern - Business logic separation with dependency injection
- Factory Pattern - FastAPI app factory for different deployment modes
- Strategy Pattern - Pluggable components (storage, rate limiting, secrets)
- Layered Security - Multiple security layers with defense in depth
- Async-First Design - Scalable performance with modern Python patterns
- Type Safety - Comprehensive type annotations and validation
- Configuration Management - Flexible config with multiple providers
- ✅ OAuth 2.1 Complete - All endpoints, flows, and security features
- ✅ OIDC 1.0 Complete - ID tokens, UserInfo, JWKS, discovery
- ✅ Admin System Complete - CLI, API, security, user management
- ✅ Production Ready - Docker, monitoring, deployment, documentation
- ✅ Test Excellence - 439/439 tests passing with comprehensive coverage
- ✅ 6 RFC Specifications implemented and validated
- ✅ Security Best Practices - OWASP guidelines and threat modeling
- ✅ Enterprise Features - Audit logging, rate limiting, monitoring
- ✅ Developer Experience - Comprehensive docs, easy setup, great tooling
- Performance Optimization - Advanced caching and connection optimization
- Enterprise Features - Multi-tenant support, SAML integration, LDAP
- Advanced Security - FIDO2, WebAuthn, biometric authentication
- Cloud Native - Kubernetes operators, service mesh integration
This project is licensed under the MIT License - see the LICENSE file for details.
We welcome contributions! Please see our contributing guidelines and code of conduct.
- Clone the repository
- Install dependencies:
uv sync --all-groups -U - Run tests:
pytest - Start development server:
uv run python -m authly serve --embedded --dev
- Linting:
uv run ruff check . - Formatting:
uv run ruff format . - Validate Renovate config:
npx --yes --package renovate -- renovate-config-validator .github/renovate.json
- All code must include comprehensive tests
- 100% test success rate required
- Type annotations and documentation required
- Security-first development practices
Authly - Production-ready OAuth 2.1 + OpenID Connect 1.0 authorization server with enterprise-grade security and comprehensive testing.