Auth Service
A self-hosted OAuth 2.1 / OIDC identity provider built on BetterAuth. Issue tokens for any number of applications, enforce per-app RBAC, manage subscription plans, and track resource consumption — all from a single service.
What it does
OAuth 2.1 / OIDC compliant
Full authorization code flow with PKCE, client credentials, token introspection, JWKS, and standard discovery endpoints.
Multi-application RBAC
Each registered application gets its own isolated role and permission model. Users carry different roles across applications; claims are injected into JWT access tokens when the matching scope is requested.
MFA — TOTP and backup codes
Two-factor authentication via TOTP authenticator apps, with backup codes. Per-application MFA enforcement is configurable. Passkey (WebAuthn) endpoints are enabled server side.
Subscription plans
Define subscription plans with arbitrary feature flags per application. Stripe integration creates products and prices automatically. Plan and feature data are included in access tokens.
Consumption tracking
Record arbitrary numeric counters (API calls, storage used, credits spent) against any user/application pair. Raw entries and running aggregates are stored in PostgreSQL.
Organization support
Multi-tenant organizations with owner / admin / member roles. The org_id claim is injected into access tokens when the org scope is requested, enabling backend services to scope data by tenant.
Social login
Google and GitHub OAuth providers. Per-application allow-list gating controls which providers are available to each client.
Login history
Every successful login is recorded with IP address, user-agent, and application context. Available via the admin dashboard and API for audit purposes.
MCP server integration
Any MCP client can authenticate via OAuth 2.1 Authorization Code + PKCE and receive a JWT access token with roles, permissions, and feature claims. See the MCP integration guide for complete examples.
Credit wallet & LLM gateway
One prepaid euro balance per user, shared by every application. A LiteLLM gateway authenticated with auth-service tokens bills each call against it; users top up with Stripe, administrators audit everything.
Integrate or migrate
Step-by-step guides to plug a third-party application into auth-service, give it LLM access with credit control, or move an existing Okta or Keycloak deployment over.
Custom templates & branding
Override the login, register and other server-rendered pages per application, and the transactional emails globally, via TEMPLATES_DIR. APP_NAME and APP_LOGO_URL drive the branding.