OAuth 2.0 & OIDC
Authorization Code Flow with PKCE, Refresh Tokens, ROPC, Token Introspection (RFC 7662), Token Revocation (RFC 7009), Dynamic Client Registration (RFC 7591), and a full OIDC Discovery document.
Self-hosted OAuth2 / OIDC Identity Provider
Simple. Safe. Self-hosted. Identity on your terms.
What is Autentico?
Section titled “What is Autentico?”Autentico is a self-hosted OAuth 2.0 / OIDC Identity Provider designed for operational simplicity. It covers the full authentication lifecycle: login, MFA, passkeys, session management, token issuance, and administration. All in a single binary with zero external dependencies.
A typical self-hosted Identity Provider involves a database server, a cache layer, multiple processes, and everything that comes with keeping them running. Autentico removes that stack: just one binary and one database file. If you have multiple projects, point them all at one instance and centralize your users, sessions, and security in one place. The simplicity is operational, not protocol-level.
Get running in 60 seconds
Section titled “Get running in 60 seconds”./autentico start --auto-setupOpen http://localhost:9999/onboard, set your admin username and password. You’re in.
No Docker, no database to provision, no config files to edit.
Try it live
Section titled “Try it live”A fresh, dedicated Autentico instance is provisioned just for you.
Each session is isolated and ephemeral. All data is purged after 24 hours.
Features
Section titled “Features”Passkeys & MFA
WebAuthn/FIDO2 passkey authentication, TOTP with in-browser QR enrollment, Email OTP, and trusted device recognition to reduce MFA friction on known devices.
Admin & Account UI
A built-in React dashboard for managing users, clients, and sessions. A self-service account portal lets users manage their profile, change password, enroll TOTP, and register passkeys.
Zero Dependencies
Single Go binary with embedded SQLite. No Postgres, no Redis, no sidecars. ~40MB idle, ~100MB under heavy load. Deploy anywhere a binary can run.
Flexible Configuration
Immutable bootstrap settings from .env, runtime settings in the database
(hot-reloadable), and per-client overrides for token TTLs, auth modes, and
more.
Production Ready
RS256 JWT signing, CSRF protection, bcrypt password hashing, account lockout, rate limiting, and configurable session timeouts. Passes the OpenID Foundation Basic OP certification test.