AuthKit

AuthKit turns an AdonisJS app into a full OpenID Connect Authorization Server — and gives you a matching client kit so your other apps can authenticate against it. It is built on top of oidc-provider and the AdonisJS HTTP layer, but you only ever touch a typed defineConfig surface and a handful of registration helpers.

The packagesCopy Anchor Link

AuthKit is a family of independently versioned packages rather than one dependency. You install only the side of the wire you are on: an Identity Provider installs authkit-server, a relying party installs authkit-client, and everything else is additive.

The two ends of the wireCopy Anchor Link

Building on topCopy Anchor Link

Keystore vaults (optional companions)Copy Anchor Link

Only relevant when the IdP runs with a managed JWKS. Each package puts the private signing keystore inside a managed cloud secrets service and is lazy-loaded by authkit-server from the jwks.store.driver you configure — see Keystore vaults.

Key featuresCopy Anchor Link

• OIDC provider — authorization code + PKCE, refresh tokens, ID tokens, JWKS, and a discovery document, all mounted under a single mountPath.
• Personal Access Tokens (PAT) — issue / list / revoke long-lived tokens for machine-to-machine access, validated by a server-to-server introspection endpoint.
• Impersonation — RFC 8693 token-exchange so an admin can act as another user, recorded in the act claim.
• MFA / TOTP & WebAuthn passkeys — opt-in authenticator enrollment (QR), a login-time challenge, single-use recovery codes, and passwordless passkey sign-in.
• Passwordless — magic-link email sign-in alongside passwords.
• Organizations (multi-tenancy) — capability-probed multi-org support with member roles, email invitations, org-claim tokens, and a full Admin API. See Organizations.
• LGPD / GDPR compliance — self-service account deletion with full cascade and anonymized audit trail, data export, and a verified-email gate. See Compliance.
• JWT access tokens (RFC 9068) — switch to self-contained JWTs verifiable without introspection; per-resource-server audience/scope/TTL via RFC 8707. See Security.
• Password hygiene — configurable policy, HaveIBeenPwned breach detection, lazy rehash on login, legacy hash verifier, and bulk user import. See Passwords & Migration.
• Bot protection — pluggable CAPTCHA/challenge (Turnstile, hCaptcha, reCAPTCHA) with fail-safe semantics. See Security.
• Admin REST API — a versioned /api/authkit/v1 (users / clients / sessions / orgs / stats / audit / token-verify) secured by API keys, plus a server-rendered admin console.
• SDK — @adonis-agora/authkit-sdk, a typed client for the Admin API that runs in remote (HTTP) or embedded (in-process) mode.
• Device flow, DPoP, PAR & step-up — OAuth device authorization grant, sender-constrained tokens, pushed authorization requests, and re-authentication for sensitive actions.
• Account linking & dynamic registration — link multiple identity providers and let clients self-register via RFC 7591.
• Events & webhooks — subscribe to lifecycle events in-process or via outbound webhooks.
• React frontend — @adonis-agora/authkit-react with useAuth(), headless hooks, organization hooks, PasswordStrengthMeter, and pre-built components (see React).
• Audit logging — a pluggable AuditSink receives security-relevant events (login.success, pat.issued, impersonation, mfa.enabled, …).
• Rate-limiting — opt-in anti-brute-force throttles on the sensitive routes, backed by @adonisjs/limiter.
• RP-initiated logout — buildEndSessionUrl ends the SSO session and bounces the browser back to a registered post_logout_redirect_uri.
• Deployment-topology-agnostic — run a dedicated IdP app, or embed the provider inside an existing app where the host is also one of its own clients.

Where to go nextCopy Anchor Link

• Getting started — install, configure, and mount the host.
• Topologies — standalone vs embedded deployments.
• Client — wire up a relying party.
• Reference — the full defineConfig option tables.