Open source · MIT · Alpha
Authworks is an open-source (MIT) identity API with users, organizations, OIDC, MFA, passkeys and machine access — self-hosted as a single Bun service.
bun add @adaptive-ds/authworksimport { projectApiClientCreate,} from "@adaptive-ds/authworks/projects"const client = projectApiClientCreate({ baseUrl: SERVER_URL, token: TOKEN,})await client.projectUserAssignmentCreate(REALM_ID, PROJECT_ID, { userId: USER_ID, roleKeys: ["reader"],})Features
Users, organizations, protocols and machine access — all in one Bun/TypeScript package.
Registration, login and sessions for your users, with verification and recovery built in.
Multi-tenant structure with realms, organizations and fine-grained permissions.
Turn Authworks into the identity provider for your apps and services.
Stronger sign-in with phishing-resistant options and step-up checks.
API keys and tokens for services, scripts and integrations.
Support tooling for operators, with every privileged action logged.
Developers
Everything a TypeScript team needs to integrate Authworks: typed clients, a scriptable CLI, and standard OIDC discovery.
import { projectApiClientCreate,} from "@adaptive-ds/authworks/projects"const client = projectApiClientCreate({ baseUrl: SERVER_URL, token: TOKEN,})await client.projectUserAssignmentCreate(REALM_ID, PROJECT_ID, { userId: USER_ID, roleKeys: ["reader"],})Call every endpoint with full TypeScript types, from user management to project assignments.
Reuse the same Valibot schemas and Drizzle models the server runs on.
Script every workflow from the terminal, with named profiles for local and hosted environments.
Security
Rate limiting, isolation, and audit trails are part of the platform, not add-ons.
Rate limiting and account lockout protect sign-in and recovery flows.
Require stronger authentication before sensitive actions.
Realms and organizations stay isolated, down to per-organization login and provider policy.
The append-only event log records what happened while excluding secrets.
Users are notified about security-relevant changes to their accounts.
Admin impersonation runs under authorization limits and leaves audit events.
Self-host
Authworks deploys as a single Bun service behind Caddy with a file-backed SQLite database. Your data never leaves your infrastructure.
Your app
Your product, wired up via OIDC
Caddy
Reverse proxy in front of the service
Authworks (Bun)
API, CLI, and OIDC provider in one service
SQLite (WAL)
File-backed database plus the append-only event log
Open-source and self-hosted, with a typed TypeScript client and CLI included.