Documentation

Build secure sign-in into your stack.

Start with a framework quickstart, then read the guides when you need the details.

Next.js

Use Auth.js v5 or NextAuth v4.

Connect the Authfu plugin.

Native OIDC — sign-in is st.login().

Assignments, groups, policies — and why somebody was refused.

Apps, roles, groups, and agent identities from the terminal.

Google, Microsoft, and GitHub — free, zero config.

Okta and Entra ID provision people and groups; deactivate in the directory, revoked here at once.

Electron, CLIs, and native apps — the loopback flow, no secret, PKCE.

Delegated identity — one MCP server calling another on the caller's behalf.

Canonical machine-readable instructions.