Self-hosted identity that boots in minutes, not afternoons.
Idenplane is an AGPL-licensed identity server for teams that don't want a SaaS bill, a JVM, or vendor lock-in. Standards-compliant OAuth 2.0, OIDC, and SAML 2.0, with first-class SDKs for TypeScript, React, Next.js, iOS, and Android.
Free, open source, and self-hosted — running in about 30 seconds.
What you get out of the box
Everything you need to authenticate users and protect APIs — built on standards your auditors already know.
OAuth 2.0 + OpenID Connect
Authorization Code with PKCE, Client Credentials, Device Authorization (RFC 8628), Refresh Token grants. OIDC Core 1.0 with discovery, backchannel logout, and session management.
Read the docsSAML 2.0 Identity Provider
Issue signed SAML assertions to your registered Service Providers, exchange metadata, and broker external OIDC/social identity providers — enterprise SSO into your apps.
Read the docsMFA, Passwordless and Step-Up
TOTP authenticators, FIDO2/WebAuthn for hardware keys and biometrics, recovery codes, brute-force protection, and progressive ACR step-up for sensitive operations.
Read the docsMulti-Tenant Realms and Organizations
Isolated realms with independent users, clients, signing keys, themes, and configurations. Org-level B2B teams, member invitations, hierarchical roles, and real DNS TXT domain verification for SaaS multi-tenancy.
Read the docsFederation and Social Login
Broker external OIDC and SAML identity providers — Google, GitHub, Microsoft, Apple, or any compliant IdP. LDAP/Active Directory sync, on-demand or scheduled imports.
Read the docsRisk-Based Authentication Beta
Score login attempts on signals like IP reputation, device posture, geo-velocity, and time-of-day using a rule-based weighted engine. Trigger step-up MFA or block on threshold. APIs to plug in your own scoring.
Read the docsNon-Human Identity
Manage service accounts, AI agents, and workload identities separately from human users — mTLS-enforced credentials, device certificates, scheduled credential rotation, and fleet bulk-registration.
Read the docsAdmin Console
React 19 dashboard for realms, users, clients, roles, groups, sessions, and events. Per-realm theming, real-time updates, and full CRUD on every resource the API exposes.
Read the docsSDKs and CLI
First-party SDKs for TypeScript, React, Next.js, Vue, Angular, iOS (Swift), and Android (Kotlin). Five lines to authenticate. A CLI for realm provisioning and CI workflows.
Read the docsSafe In-Place Upgrades
Pre-upgrade validation, config-compatibility checks, an automatic pg_dump backup before every migration, and a one-command rollback if a post-upgrade health check fails.
Read the docs10 SDKs for every platform
First-class SDKs for web, mobile, and server. OAuth 2.0 + PKCE, automatic token refresh, and platform-native features like biometrics. Install and authenticate in 5 lines.
idenplane-sdk Zero-dependency core + React hooks at idenplane-sdk/react
idenplane-nextjs Middleware, Server Components, API routes
idenplane-vue Composables, plugin, router guard
idenplane-angular IdenplaneModule, AuthService, AuthGuard, AuthInterceptor
Idenplane (Swift Package Manager) Experimental Experimental · Keychain storage, Face ID / Touch ID
idenplane-android (Gradle) EncryptedPrefs, BiometricPrompt
github.com/idenplane/idenplane/packages/idenplane-go Server-side OIDC discovery cache and admin user API
idenplane (PyPI) Server-side OIDC discovery cache and admin user API
idenplane-cli Manage realms, users, clients, and roles from the terminal
com.idenplane:idenplane-java v1.0.0 on Maven Central · Spring Boot, Jakarta, Reactive
npm install idenplane-sdk
View all SDK docs
import { IdenplaneClient } from 'idenplane-sdk';
const idenplane = new IdenplaneClient({
url: 'https://auth.example.com',
realm: 'my-realm',
clientId: 'my-app',
redirectUri: 'http://localhost:5173/callback',
refreshStrategy: 'rotation',
});
await idenplane.init();
if (!idenplane.isAuthenticated()) {
await idenplane.login();
}
const user = idenplane.getUserInfo();
console.log(user.name, user.email);One compact data-flow
Requests flow top-to-bottom — client to protocol to engine to identity to data. Every layer is replaceable, every layer is observable.
-
Client Apps
Your SPAs, servers, mobile apps and CLIs
ReactNext.jsVue / AngulariOS / AndroidCLI / M2M -
Protocol Layer
Standards-compliant endpoints
OAuth 2.0 + PKCEOpenID Connect 1.0SAML 2.0Device AuthorizationJWKS / Discovery -
Auth Engine
Login flows, MFA and session management
Login FlowsMFA / WebAuthnStep-Up AuthRisk ScoringSSO Sessions + 3 more -
Identity Core
Resources, policies and federation
UsersRealmsRoles & GroupsOrganizationsFederation / LDAP + 4 more -
Data & Infrastructure
Persistent storage, cache and email
PostgreSQL 16MySQL 8+RedisLDAP / ADEmail (SMTP + 4 more)
Observability (Prometheus metrics, audit events, structured Pino logs) attaches at every layer. Read the architecture guide
Idenplane vs. the rest
Honest comparison. Sources and dates linked below — open a PR if anything is outdated.
Snapshot as of . See notes below the table.
Suggest a correction| Feature | Idenplane | Keycloak | Auth0 | Clerk | SuperTokens |
|---|---|---|---|---|---|
| Deployment | |||||
| Self-hosted (on your infra) 1 | N/A | N/A | |||
| Hosted / managed option | |||||
| Open source | |||||
| Docker one-liner 1 | N/A | N/A | |||
| Kubernetes / Helm 1 | N/A | N/A | |||
| Horizontal scaling | |||||
| Protocols | |||||
| OAuth 2.0 + PKCE | ~ 3 | ||||
| OpenID Connect 1.0 | ~ 3 | ||||
| SAML 2.0 | ~ 2 | ||||
| Device authorization | |||||
| Step-up authentication | ~ | ~ | |||
| MFA & Passwordless | |||||
| TOTP (authenticator app) | |||||
| WebAuthn / FIDO2 | |||||
| Recovery codes | |||||
| Brute-force protection | |||||
| Identity | |||||
| Multi-tenant realms | |||||
| B2B organizations | ~ | ~ | |||
| RBAC (roles & groups) | |||||
| LDAP / Active Directory | |||||
| Social & enterprise IdP | |||||
| Custom attributes | ~ | ||||
| Developer Experience | |||||
| Modern admin console | |||||
| REST API | |||||
| Web SDKs (React / Vue / Angular) | ~ | ||||
| Mobile SDKs (iOS / Android) | ~ | ||||
| CLI tool | |||||
| Webhooks | ~ | ||||
| Plugin / extension system | ~ | ||||
| Operations | |||||
| Prometheus metrics | |||||
| Health-check endpoints | |||||
| Rate limiting | ~ | ||||
| Audit logging | |||||
| Realm / tenant theming | ~ | ||||
| Implementation language | TypeScript | Java | N/A (SaaS) | N/A (SaaS) | TypeScript |
| Memory under load 4 | ~150 MB | ~1.25 GB | N/A | N/A | ~200 MB |
| Local-dev setup time 4 | ~30 sec | ~5 min | ~2 min | ~2 min | ~5 min |
| Official SDK count | 10 | 2 | 10+ | 5+ | 4 |
| Pricing model | AGPL-licensed | Apache 2.0 | Freemium $$$ | Freemium $$ | Apache 2.0 + paid add-ons |
- Auth0 and Clerk are managed SaaS — self-hosting is not an option, not an absence. Marked N/A in deployment rows.
- Clerk SAML SSO and enterprise SSO connections require the Enterprise plan (clerk.com/pricing).
- SuperTokens implements OAuth 2.0 / OIDC for select flows; coverage is more limited than Keycloak or Auth0 (supertokens.com).
- Memory and setup-time figures are from internal k6 load tests (50 virtual users, 60s, single realm, default config) — not idle measurements. Idenplane and Keycloak ran the identical workload; SuperTokens, Auth0, and Clerk figures are estimates, not benchmarked. Workload dictates real-world usage.
Local dev in 30 seconds
Three commands to a working identity server. Production checklist included — don't ship the local config.
Bring up Postgres, Redis, and Idenplane
Drop the compose file into your project and start the stack. The image is pinned to v1.0.0 — bump it in your own infra on your own schedule.
# compose.yaml
services:
postgres:
image: postgres:16-alpine
environment:
POSTGRES_USER: idenplane
POSTGRES_PASSWORD: change-me-in-production
POSTGRES_DB: idenplane
volumes:
- pgdata:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U idenplane"]
interval: 5s
retries: 5
redis:
image: redis:7-alpine
volumes:
- redisdata:/data
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
retries: 5
idenplane:
image: islamawad/idenplane:0.4.0 # pin a version tag in prod
depends_on:
postgres: { condition: service_healthy }
redis: { condition: service_healthy }
environment:
DATABASE_URL: postgresql://idenplane:change-me-in-production@postgres:5432/idenplane
REDIS_URL: redis://redis:6379
ADMIN_API_KEY: replace-with-a-long-random-string
WEBHOOK_SECRET_KEY: replace-with-a-long-random-string
WEBHOOK_ENCRYPTION_SALT: replace-with-a-unique-random-salt
ports:
- "3000:3000"
volumes:
pgdata:
redisdata:$ docker compose up -d Create a realm and a client
Hit the admin API or open the Admin Console at http://localhost:3000/console, authenticating with the ADMIN_API_KEY you set above.
curl -X POST http://localhost:3000/admin/realms \
-H "x-admin-api-key: $ADMIN_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"my-app","displayName":"My App"}'Wire the SDK into your app
Install the SDK for your framework and point it at your realm. Five lines is enough for the auth code + PKCE flow.
npm install idenplane-sdkProduction checklist
You are running locally. Before you ship, walk through this list. The docs link below has the full version with example configs and rollout patterns.
- TLS / HTTPS
Terminate TLS at a reverse proxy (Caddy, Traefik, Nginx) or your platform's load balancer. Idenplane sets HSTS and secure cookies when it sees an HTTPS request.
- Secrets
Replace every change-me value: DATABASE_URL credentials, JWT_SECRET (32+ random bytes), and admin bootstrap password. Pull from your secret manager, not the compose file.
- Backups
Schedule pg_dump or your platform's managed Postgres backups. Test restores monthly. Redis is cache-only — losing it is fine, losing Postgres is not.
- Observability
Scrape /metrics for Prometheus, ship structured JSON logs from stdout to your log aggregator, and add /healthz to your liveness probe.
http://localhost:3000 Need more depth? Read the full deployment guide →
Powerful Admin Dashboard
Full-featured React 19 admin console for managing realms, users, clients, roles, groups, sessions, identity providers, and audit logs — all in real time.
Idenplane Console production Dashboard
Built in the open.
Owned by you.
No vendor lock-in. No surprise pricing. Fork it, extend it, self-host it. Your identity infrastructure, your rules.
Sponsor Idenplane on GitHub
Recurring sponsorship funds maintenance, security fixes, and new SDKs.
How to contribute
Spread the word
Star the repo, share on social, write about your experience with it.
Star on GitHub →For developers
Read the source, run the tests, integrate the SDK.
For teams
Deploy to your infrastructure and manage identity across all your applications.
Things you'll actually ask
The short, honest answers.
Why not just use Keycloak?
Keycloak is the right answer if you have a JVM team and want every IAM feature ever shipped. Idenplane targets a different point on the curve — a TypeScript codebase, a smaller memory footprint, modern SDKs, and a build/deploy story that fits a Node-shop CI. If you already run Java in production and need every Keycloak feature, stay on Keycloak. If you want a TypeScript stack with the protocols that actually matter, try Idenplane.
Is Idenplane production-ready?
Idenplane is at v1.0.0 with the OAuth 2.0, OIDC, SAML 2.0, MFA, WebAuthn, federation, and admin surface area you need to run authentication. It has not been third-party penetration-tested or independently audited. Use the comparison table to map what you need against what is in the box, run our suggested deployment, and decide for your own risk tolerance. "Production-ready" is a property of your deployment, not just the software.
Who maintains it?
Idenplane is maintained by a small open-source team led by the original author. The repository lives at github.com/idenplane/idenplane — issues, pull requests, and discussions are all public. There is no commercial entity behind it today, and no plans to relicense.
How are CVEs and vulnerabilities handled?
Report privately via [email protected] or by opening a GitHub Security Advisory at github.com/idenplane/idenplane/security/advisories/new. We aim to acknowledge within 72 hours, fix within 90 days, and coordinate disclosure with you. Fixes ship as patch releases; advisories are published on the GitHub Security tab once a fix is available. See our security.txt for the canonical contacts.
What's the upgrade story?
Idenplane follows semver. Patch (1.0.x) and minor (1.x.0) releases are backward-compatible and ship with the same image tag scheme. Database migrations run automatically on container start. Major releases (e.g. 2.0.0) document breaking changes in CHANGELOG.md and ship a migration guide. Pin a version tag in production and read the changelog before bumping.
Have a question that isn't here? Open a discussion on GitHub →