Skip to content

Features

Authentication

  • Passwords: Argon2id hashing, a configurable password policy, and an optional check against Have I Been Pwned
  • Magic links: one-time sign-in links sent by email (guide)
  • TOTP: authenticator apps, with backup codes (guide)
  • Email OTP: one-time codes sent by email (guide)
  • WebAuthn / passkeys: platform and roaming authenticators
  • Social login: Google and GitHub, through the OAuth client (reference)
  • Identifiers: email, username or phone number

Sessions

  • Token-based sessions, stored hashed, with a sliding expiry window (reference)
  • Revocation of one session or of all of a user's sessions

Authorization

  • Roles and permissions (RBAC), with built-in roles and roles given to the first user (guide)
  • Policy-based checks for rules that roles cannot express
  • Groups and invitations: group membership, and invitations sent by email (guide)

Identity Provider

  • OAuth 2.1 server: authorization code with PKCE, refresh token and client credentials grants; revocation and introspection; opaque or JWT access tokens
  • OpenID Connect 1.0 provider: ID tokens, JWKS, UserInfo, discovery, consent, RP-initiated logout and dynamic client registration (guide)
  • SCIM 2.0 server: User and Group resources, with filters and discovery (guide)
  • LDAP backend: a read-mostly LDAP or Active Directory subject store, with bind authentication (guide)

Administration

  • Admin console: a Litestar app to manage subjects, roles, groups, sessions and the audit log, with bulk import and export
  • neozen serve: the console, the health checks and the database migrations in one self-hosted service (quickstart)

Security

  • Timing-safe comparisons for secrets and tokens
  • Rate limiting and account lockout (configuration)
  • Audit logging
  • CSRF protection in the admin console and the OIDC consent form
  • Refresh-token rotation, with replay detection

Integration

  • Frameworks: adapters for Flask, Litestar and Starlette
  • Storage: SQLAlchemy, Peewee, Tortoise ORM or plain SQL, behind one repository protocol (architecture)
  • Your own model: factory functions and protocols instead of base classes (guide)
  • i18n: catalog-based translations, with English and French built in