Hosted pages on your domain
Sign in, sign up, reset, invites, consent and an account page, with your branding, on microauth.dev or your own subdomain.
Authentication
Sign in for your apps, on your own domain
MicroAuth hosts the sign in pages, the accounts and the OAuth server. Your apps use OAuth 2.1 and OpenID Connect, read roles and permissions, and never handle a password.
from fastapi import Depends, FastAPI
from microauth_fastapi import User, UserAuth
app = FastAPI()
auth = UserAuth(app) # adds /auth/login, /auth/callback and /auth/logout
@app.get("/dashboard")
async def dashboard(user: User = Depends(auth.login_required)):
return {"hello": user.name, "roles": sorted(user.roles)}
@app.post("/posts")
async def create_post(user: User = Depends(auth.require(permissions="posts:write"))):
...Sessions live in an encrypted, HttpOnly cookie, so browser JavaScript never holds a token.
from fastapi import Depends, FastAPI
from microauth_fastapi import TokenAuth, TokenClaims
app = FastAPI()
api = TokenAuth(app) # reads MICROAUTH_ISSUER and MICROAUTH_RESOURCE
@app.get("/posts")
async def posts(token: TokenClaims = Depends(api.require("posts:read"))):
return {"user": token.sub, "app": token.client_id}Access tokens are checked locally against your service's signing keys. A token made for another API is refused.
from fastapi import Depends, FastAPI
from microauth_fastapi import TokenAuth, TokenClaims
app = FastAPI()
api = TokenAuth(app, api_keys=True) # also reads the API's server credentials
@app.post("/posts")
async def create_post(caller: TokenClaims = Depends(api.require("posts:write"))):
return {"author": caller.sub, "via": caller.via}The same route accepts access tokens and the keys people make for their own accounts, with the same permission checks.
How it works
Standard sign in, run for you
People sign in on pages MicroAuth hosts at your sign in address. Your apps get tokens through the standard code flow and check them locally.
Your app sends them to sign in
A page that needs a signed in user sends the browser to your sign in service, with a one time PKCE challenge.
They sign in on your pages
With a password, a passkey or a provider like Google. Someone already signed in to another of your apps skips this step.
Your server gets tokens
MicroAuth sends the browser back with a short lived code, and your server exchanges it for tokens.
Your app keeps its session
The SDK keeps it in an encrypted cookie and refreshes tokens, so new roles and suspensions reach your app.
Hosted sign in
Sign in pages on your own domain
Sign in, sign up, password resets, invites, passkeys and two step verification, with your logo and colors. They are live at yourapp.microauth.dev right away, and can move to a domain of yours like auth.example.com on plans that include one.
People also get an account page for their profile and photo, sessions, connected providers and the apps they allowed. Security emails go out under your app's name.
Open standards
OAuth 2.1 and OpenID Connect
Every app uses the code flow with PKCE. Access tokens are short lived JWTs for one API, refresh tokens change on every use, and ID tokens tell your app who signed in and how.
Web apps, single page apps and native apps all work, with any OpenID Connect library in any language. With FastAPI, the SDK does it in a few lines.
GET /.well-known/openid-configuration
{
"issuer": "https://auth.example.com",
"authorization_endpoint": "https://auth.example.com/oauth/authorize",
"token_endpoint": "https://auth.example.com/oauth/token",
"jwks_uri": "https://auth.example.com/oauth/jwks",
"code_challenge_methods_supported": ["S256"],
"scopes_supported": ["openid", "profile", "email",
"offline_access", "roles", "posts:read", "posts:write"]
}
Access control
Roles, permissions and your users
Define permissions such as posts:write and group them into roles. Your app reads them from the session, and they become the OAuth scopes of your APIs and MCP servers.
The users page lets you search, change roles, see sessions and connected apps, suspend someone, sign them out everywhere, send a password reset or invite new people.
Features
What your sign in service includes
OAuth 2.1 and OpenID Connect
Discovery, PKCE for every app, pushed authorization requests, rotating refresh tokens, userinfo, revocation, introspection and sign out.
Roles and permissions
Permissions you name, roles that bundle them, and default roles for new users. Changes reach your app within one token lifetime.
User management
Search users, change roles, suspend, sign out everywhere, send a reset, remove two step verification, delete or invite.
External sign in
Google, GitHub, any OpenID Connect provider or a generic OAuth 2.0 one, with your own client credentials and safe account linking.
Passkeys and two step
Passkeys, authenticator apps and recovery codes on your sign in pages, with security emails under your app's name.
API keys for your users
People create keys for scripts and CI with the permissions they choose. Your API checks them with TokenAuth or standard token introspection.
AI access
The same service lets AI clients use your MCP servers for a person, with consent. See AI access.
A FastAPI SDK
UserAuth for web apps and TokenAuth for APIs, in one package. See the SDK.
Questions
About sign in
Do I have to use FastAPI?
No. Sign in is standard OpenID Connect, so any OpenID Connect library works, in any language. Access tokens are JWTs your API can check with the published signing keys, and API keys can be checked with standard token introspection. FastAPI gets an SDK that does all of it in a few lines.
Where do browser sessions live?
The sign in pages keep their own session on your sign in domain, which gives single sign on across your apps. Each app runs the code flow on its server, and the FastAPI SDK keeps its session in an encrypted, HttpOnly cookie. No token is ever handed to browser JavaScript.
Can my users sign in with Google or GitHub?
Yes, with your own client credentials from Google or GitHub. You can also add any OpenID Connect provider, or a generic OAuth 2.0 one. The pricing page shows which plans include each.
How do role changes reach my app?
Roles and permissions are read again on every token refresh. Access tokens last 10 minutes by default, so a role you remove, or a suspension, reaches your app within one access token lifetime.
Add sign in to your app today
Create a sign in service in the dashboard, register your app and add a few lines with the FastAPI SDK. Your sign in pages are live right away.