Introduction

Production-ready OAuth 2.0 Server and OpenID Connect 1.0 Provider

Authority is a complete authentication infrastructure built with Crystal, featuring enterprise-grade security and a modern admin dashboard.

Quick Start

Get Authority running in 5 minutes:

# Clone the repository
git clone https://github.com/azutoolkit/authority.git
cd authority

# Start with Docker
docker-compose up -d

# Visit http://localhost:4000

See Quick Start Tutorial for a complete walkthrough.

Key Features

Category	Features
OAuth 2.0	Authorization Code, PKCE, Client Credentials, Device Flow, Refresh Tokens
OpenID Connect	ID Tokens, UserInfo, Discovery, JWKS
Security	MFA/TOTP, Account Lockout, Password Policies, Audit Logging
Admin	Client Management, User Management, Scope Configuration, Settings

Documentation Overview

This documentation is organized using the Diataxis framework:

Tutorials

Step-by-step guides for learning Authority:

• Quick Start - Get running in 5 minutes

• First OAuth Integration - Build your first OAuth app

• Protect Your API - Secure your endpoints

• Add User Authentication - Implement login flows

How-To Guides

Task-oriented guides for specific goals:

• Installation - Docker, source, Kubernetes

• Configuration - Environment setup

• Security - MFA, lockout, passwords

• OAuth Clients - Client management

Reference

Technical specifications and API documentation:

• OAuth 2.0 Flows - Grant type specifications

• OpenID Connect - OIDC endpoints

• API Endpoints - Complete API reference

• Configuration - All settings

Explanation

Understanding concepts and architecture:

• Architecture - System design

• OAuth 2.0 Concepts - Protocol fundamentals

• Security Model - Security architecture

• Choosing Grant Types - Decision guide

Standards Compliance

Authority implements these specifications:

• RFC 6749 - OAuth 2.0 Authorization Framework

• RFC 6750 - Bearer Token Usage

• RFC 7519 - JSON Web Token (JWT)

• RFC 7636 - Proof Key for Code Exchange (PKCE)

• RFC 7662 - Token Introspection

• RFC 7009 - Token Revocation

• RFC 8628 - Device Authorization Grant

• OpenID Connect Core 1.0

Technology Stack

Component	Technology
Language	Crystal
Web Framework	Azu
Database	PostgreSQL
Templating	Crinja (Jinja2-compatible)
Caching	Redis (optional)

Screenshots

Landing Page

Admin Dashboard