AuthKit

AuthKit turns an AdonisJS app into a full OpenID Connect Authorization Server — and gives you a matching client kit so your other apps can authenticate against it. It is built on top of oidc-provider and the AdonisJS HTTP layer, but you only ever touch a typed defineConfig surface and a handful of registration helpers.

The packages

AuthKit is a family of independently versioned packages rather than one dependency. You install only the side of the wire you are on: an Identity Provider installs authkit-server, a relying party installs authkit-client, and everything else is additive.

The two ends of the wire

Building on top

Keystore vaults (optional companions)

Only relevant when the IdP runs with a managed JWKS. Each package puts the private signing keystore inside a managed cloud secrets service and is lazy-loaded by authkit-server from the jwks.store.driver you configure — see Keystore vaults.

Key features

• OIDC provider — authorization code + PKCE, refresh tokens, ID tokens, JWKS, and a discovery document, all mounted under a single mountPath.
• Personal Access Tokens (PAT) — issue / list / revoke long-lived tokens for machine-to-machine access, validated by a server-to-server introspection endpoint.
• Impersonation — RFC 8693 token-exchange so an admin can act as another user, recorded in the act claim.
• MFA / TOTP & WebAuthn passkeys — opt-in authenticator enrollment (QR), a login-time challenge, single-use recovery codes, and passwordless passkey sign-in.
• Passwordless — magic-link email sign-in alongside passwords.
• Organizations (multi-tenancy) — capability-probed multi-org support with member roles, email invitations, org-claim tokens, and a full Admin API. See Organizations.
• LGPD / GDPR compliance — self-service account deletion with full cascade and anonymized audit trail, data export, and a verified-email gate. See Compliance.
• JWT access tokens (RFC 9068) — switch to self-contained JWTs verifiable without introspection; per-resource-server audience/scope/TTL via RFC 8707. See Security.
• Password hygiene — configurable policy, HaveIBeenPwned breach detection, lazy rehash on login, legacy hash verifier, and bulk user import. See Passwords & Migration.
• Bot protection — pluggable CAPTCHA/challenge (Turnstile, hCaptcha, reCAPTCHA) with fail-safe semantics. See Security.
• Admin REST API — a versioned /api/authkit/v1 (users / clients / sessions / orgs / stats / audit / token-verify) secured by API keys, plus a server-rendered admin console.
• SDK — @adonis-agora/authkit-sdk, a typed client for the Admin API that runs in remote (HTTP) or embedded (in-process) mode.
• Device flow, DPoP, PAR & step-up — OAuth device authorization grant, sender-constrained tokens, pushed authorization requests, and re-authentication for sensitive actions.
• Account linking & dynamic registration — link multiple identity providers and let clients self-register via RFC 7591.
• Events & webhooks — subscribe to lifecycle events in-process or via outbound webhooks.
• React frontend — @adonis-agora/authkit-react with useAuth(), headless hooks, organization hooks, PasswordStrengthMeter, and pre-built components (see React).
• Audit logging — a pluggable AuditSink receives security-relevant events (login.success, pat.issued, impersonation, mfa.enabled, …).
• Rate-limiting — opt-in anti-brute-force throttles on the sensitive routes, backed by @adonisjs/limiter.
• RP-initiated logout — buildEndSessionUrl ends the SSO session and bounces the browser back to a registered post_logout_redirect_uri.
• Deployment-topology-agnostic — run a dedicated IdP app, or embed the provider inside an existing app where the host is also one of its own clients.

Where to go next

• Getting started — install, configure, and mount the host.
• Topologies — standalone vs embedded deployments.
• Client — wire up a relying party.
• Reference — the full defineConfig option tables.