Overview

authbase is an authentication service you run yourself. Run one instance, create an app for each product you build, and let each product’s backend register and authenticate its users through authbase. Think of it as a smaller, self-hostable Auth0 or Firebase Auth.

  end-user ──▶ your backend ──(API key)──▶ authbase ──▶ PostgreSQL
                    │                          │
                    └── verifies tokens ◀── JWKS (public keys, cached)

Your backend calls authbase with an API key for four things: sign-up, login, refresh and logout. Every other request is checked locally: the access token is a standard JWT that your backend verifies against the app’s public keys, so authbase is never on your hot path.

What you get

• The end-user API: registration, login by email or username, refresh with reuse detection, logout and “sign out everywhere”, roles and metadata, password reset and email verification with hosted pages.
• A dashboard at the instance’s root: apps, API and signing keys, users, settings, the audit log and your own account.
• SDKs for Node (@authbase/node: Express, Hono, Next.js) and Kotlin/JVM (Ktor and Spring Boot). Anything else needs only JSON over HTTP and a JWT library (integration guide).
• Standards: Ed25519 (EdDSA) access tokens per RFC 9068, a JWKS and OIDC discovery document per app, RFC 9457 problem details with stable error codes, an OpenAPI spec.
• Protection that is always on: Argon2id, a breached-password list, per-IP and per-key rate limits, lockout, an audit log, signing and API key rotation without downtime.
• One binary, one PostgreSQL, one master key to operate.

Where to start

You want to…	Read
see it work on your machine in under half an hour	Quick start
understand apps, keys and tokens first	Concepts
add it to a Node or Kotlin backend	Node SDK, Kotlin SDK
add it to anything else	Integration guide
look up an endpoint or error code	API reference
run it in production	Self-hosting, Security model
have a coding agent do the integration	Docs for agents, Claude skills

Status

authbase is in active development. The API, email flows, dashboard and SDKs are complete, and it runs in production for its author. The source code, the container image and the SDK packages are not public yet: they come with the first public release, together with an independent security review and signed builds. Until then, this site introduces the project and documents how it works, and its install steps describe the release.

Not there yet: teams that share apps, a hosted login page (OAuth 2.0 code flow with PKCE), multi-factor authentication, social login and webhooks.