PortaMulti-tenant OIDC Provider

Authentication, User Management, RBAC & Custom Claims — built on node-oidc-provider

Global Apps, Tenant Clients

Applications, modules, roles, and permissions are deployment-global; organizations own their clients, users, and assignments.

Path-based organization isolation with per-tenant OIDC endpoints, branding, and configuration.

Built on node-oidc-provider with PKCE, Authorization Code flow, refresh tokens, and discovery.

Password and magic link authentication, configurable per organization and per client with inheritance.

Email OTP, TOTP authenticator apps, and recovery codes with per-org policy enforcement.

Per-org branding via API, custom CSS injection, or full Handlebars template override via Docker volume mount.

Full user lifecycle — registration, invitation, password reset, magic links, and status management.

Application-scoped roles and permissions with type-validated custom claims injected into tokens.

Full-featured CLI and JWT-authenticated API for managing organizations, apps, clients, users, and RBAC.

Universal SDK for browser, Node.js, and AI agents — 19 domain namespaces, typed errors, auto-pagination, and ETag concurrency.

Three-point lifecycle — explicit logout cascades tokens, natural expiry preserves refresh flows, opportunistic cleanup purges stale records.