Identity & Access
Manage users, clients, roles and permissions through one declarative API. Multi-tenant by design with realms.
With multi-realm tenancy and declarative, isomorphic permissions you can share between API, UI, and microservices.
npx authup@latest start
http://localhost:3000/http://localhost:3000/console/adminThe fastest way to try Authup — no database required, SQLite storage only. Not for production. See the deployment guide
A complete identity and access toolkit you can deploy as a service or embed as libraries.
Manage users, clients, roles and permissions through one declarative API. Multi-tenant by design with realms.
Standards-compliant authorization, refresh, password and client-credentials grants with PKCE enforcement for public clients out of the box.
Isolate users, clients and policies per realm. Mount any controller under /realms/:realmId for nested routing.
Serialize policy bindings between server, browser and microservices. The same evaluator runs in API, UI and edge functions.
Federate via LDAP and OpenID Connect upstream providers. Map external attributes onto Authup users automatically.
Seed realms, roles, users and permissions from JSON, YAML or TypeScript files. Idempotent on every startup.
Run Authup the way that fits your stack — from a single Docker container to a clustered, externally-backed deployment.
The fastest way to a working Authup stack — server, UI and database wired up.
Run server and client as separate containers behind your existing orchestrator.
Install on any host that runs Node.js — no container runtime required.
Pull the image, point it at your database, and issue your first access token.
# .env
# Point these at your own PostgreSQL, Redis and public address.
USER_ADMIN_PASSWORD=start123
DB_TYPE=postgres
DB_HOST=postgres.example.com
DB_PORT=5432
DB_USERNAME=authup
DB_PASSWORD=secret
DB_DATABASE=authup
REDIS=redis://cache.example.com:6379
PUBLIC_URL=https://auth.example.comThe reference deployment wires the server, the consent UI, PostgreSQL and Redis into a single compose file. Bring it up locally, point a reverse proxy at it in production.
authup.yml file, or both services:
server-core:
image: authup/authup:latest
restart: unless-stopped
ports:
- "3000:3000"
environment:
- PUBLIC_URL=http://localhost:3000
- DB_TYPE=postgres
- DB_HOST=postgres
- DB_USERNAME=authup
- DB_PASSWORD=secret
- DB_DATABASE=authup
- REDIS=redis://redis:6379
command: start
depends_on: [postgres, redis]
postgres:
image: postgres:16
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
- POSTGRES_DB=authup
- POSTGRES_USER=authup
- POSTGRES_PASSWORD=secret
redis:
image: redis:7
volumes:
postgres_data: