Self-hosted sign-in, single sign-on, and permissions for your apps.
Goiabada is a standards-based, open-source authentication server built on OAuth 2.0 and OpenID Connect. Your apps can use standard libraries to sign users in and obtain tokens; you choose where the auth server and database run.
Try it locally · Add sign-in to a web app · Explore the docs
- One account across your apps. Single sign-on, authorization code flow with PKCE, and optional two-factor authentication with step-up for sensitive apps.
- Control over access. Give users, groups, and clients permissions; include groups and custom attributes in tokens when your apps need them.
- An admin console and API. Manage users, clients, settings, and signing keys through the web UI or automate them through the API. Review changes in the audit log.
- Account self-service. Users can manage their profile and security settings, recover a password, and review their sessions. You can enable self-registration and email verification.
- A choice of deployment. The setup wizard prepares Docker Compose, Kubernetes, or native binary deployments. Use SQLite, PostgreSQL, MySQL, or SQL Server. Docker images support x86_64 and ARM64.
You can also enable dynamic client registration for apps such as MCP clients.
The quickstart runs Goiabada locally with Docker Compose and SQLite in a few minutes. When you're ready to run it for others, choose a deployment method.
Documentation · Contributing · MIT license
