Hellenic Identity
Sign-in on your own domain
An OAuth 2.0 identity server you run yourself: one Go binary, one PostgreSQL database, and an admin panel for your users, their schema and your client.
One binary
A Go program built on the Iris web framework. It creates its tables on first start and needs no other service to sign users in.
One database
PostgreSQL holds users, groups, clients and usage. Dragonfly or Redis is optional and only caches responses.
Your domain
Tokens, keys and the CORS allowlist live where you run it. The allowlist is edited at runtime from the panel.
4 grants, one key set
Access tokens are JWTs signed with Ed25519. Publish the keys at /.well-known/jwks.json and every service verifies on its own, or asks the server.
Authorization code
A single-use code, a state check, and a redirect URI pinned on the server. The client secret is required at the token step.
Device code
For terminals and TVs. The server ships its own consent screen and remembers the decision in a cookie.
Password
For first-party apps that hold the credentials themselves.
Refresh token
Per-client lifetimes. Bump a client's version and every token it ever issued is invalid.
// Ask the server whether a token is still good.
const res = await fetch('https://id.example.com/oauth2/token/introspect', {
method: 'POST',
headers: { 'Content-Type': 'application/json', 'X-Token': serverToken },
body: JSON.stringify({ access_token: token }),
});
const claims = await res.json(); // { username, exp, client_id, ... }Introspection
POST /oauth2/token/introspect returns the token’s claims.
Enrichment
Mint a token with extra claims for a session that needs them.
Lifetimes per client
Code, access and refresh ages set on the client.
Mass revocation
Bump the client version; older tokens stop verifying.
Describe your users once
Custom attributes are declared in the server's config with a type each. Mark a field required, or indexed for fast filtering. The panel and the API follow the schema from then on.
- text
- number
- date
- phone
- bool
- slice
- map
- uuid
Passwords
Never in the clear, not even inside TLS. The SDKs encrypt each password with AES-GCM under a key you share with the server, so a recorded exchange stays sealed against a quantum computer that breaks the TLS key exchange. At rest, a bcrypt hash.
Lifecycle
Sign up one user or import a thousand. List with filters and pages. Soft delete, restore, and reset passwords, one at a time or in bulk.
Groups are filters
A group is a saved filter over columns and attributes, nested paths included. Membership is computed when you ask for it, never stored.
- =
- IS
- IS NOT
- ILIKE
- @>
- #>>
- <
- >
- <=
- >=
- AND
- OR
Everything from one panel
Dashboard, users, groups, attributes, cache, CORS, the OAuth2 client, a request log, SDK snippets and billing. It runs in your browser against your server and keeps its token locally.
Screens below are shown with sample data.
Cache, CORS, and the bill
The three things an operator touches after the first deploy, each with its own page in the panel.
Response caching
Reads are cached in Dragonfly or Redis and writes invalidate the routes they touch. The panel shows the entry count and can flush.
CORS at runtime
Origin patterns are stored in the database and reloaded on save. Add a front end without restarting the server.
Metering
Every request records its seconds, megabytes and CPU per client. The billing endpoint totals them.
Go and C#, the same 16 calls
The Go SDK is the Iris auth SDK, shipped with the server. The C# SDK is Hellenic.Identity.SDK on NuGet, open source, with an ASP.NET Core authentication handler. Both sign users in, verify tokens against your JWKS, encrypt passwords, and manage users.
// The Iris auth SDK fetches /.well-known/jwks.json
// once and verifies every token locally.
sdk, err := identity.New[User](identity.Options{
BaseURL: "https://id.example.com",
Token: serverToken,
})
claims, err := sdk.TokenIntrospect[Claims](ctx, accessToken)// dotnet add package Hellenic.Identity.SDK
var signin = await client.UserSigninAsync(
"user@example.com", "password");
var valid = await client.VerifyTokenAsync(
signin.AccessToken); // local, against the JWKS
var claims = await client
.TokenIntrospectAsync<Dictionary<string, object>>(
signin.AccessToken);Three steps
From an empty server to a verified token in your own code.
Run the server
Write a config.yml, or let the wizard at id.hellenic.dev generate one with keys. Start the binary; it prints the server token and the encryption key.
Open the panel
Enter your server URL and the token. The panel talks to your server directly from your browser and stores nothing anywhere else.
Integrate
Add the Go or C# SDK to your apps, point it at your server, and verify tokens against your JWKS on every request.
Run sign-in on your own domain
The panel at id.hellenic.dev connects to the server you run. Setting one up? The wizard there writes your config.yml, keys included.