How authgear/authgear-server works
Authgear is an authentication and authorization service with end-user flows, an administration API, and a management portal. The principal user journey is an end user entering an AuthUI flow, which reaches server routes and OAuth authorization handling; account-management services support authenticated self-service, including authenticator changes. The README also describes MFA, social and enterprise SSO, hooks, audit logs, and RBAC. Those broader capabilities are shown at subsystem level; the sampled source does not establish all their internal wiring.
Main entry points: authflowv2.ts AuthUI flows · routes.go Auth routes · dynamicClientsQuery.graphql Authgear Portal · handler_graphql.go GraphQL transport
Components 20
End-user authentication
- AuthUI flows
authui/src/authflowv2.ts
Authgear server
- Auth routes
pkg/auth/routes.go - OAuth authorization
pkg/lib/oauth/handler/handler_authz.go - Authenticator service
pkg/lib/accountmanagement/service_authenticator.go - OIDC / SAML SSO
pkg/auth/routes.go - Hooks and events
pkg/api/event/event.go - Localized templates
pkg/util/template/engine.go
Administration
- User administration
pkg/admin/graphql/user_mutation.go - Roles and access
pkg/admin/graphql/authorization_mutation.go - Audit logs
pkg/admin/graphql/audit_log.go - GraphQL transport
pkg/admin/transport/handler_graphql.go
Management portal
- Authgear Portal
portal/src/graphql/adminapi/query/dynamicClientsQuery.graphql - OAuth client form
portal/src/hook/useOAuthClientForm.ts - Portal session state
portal/src/hook/useSessionStorage.ts
Security state
- Lockout state
pkg/lib/lockout/storage_redis.go - Rate-limit state
pkg/lib/ratelimit/storage_redis.go
Other components
- End user
- Redis
- Image cloud storage
pkg/lib/cloudstorage/cloudstorage.go - Admin API client
Connections 18
- End user → AuthUI flows: uses flows
- AuthUI flows → Auth routes: requests routes
- Auth routes → OAuth authorization: dispatches authorization
- Auth routes → OIDC / SAML SSO: dispatches SSO
- AuthUI flows → Authenticator service: requests settings
- Authenticator service → Lockout state: checks lockout
- Lockout state → Redis: stores attempts
- Rate-limit state → Redis: stores rate state
- GraphQL transport → User administration: dispatches GraphQL
- GraphQL transport → Roles and access: dispatches GraphQL
- GraphQL transport → Audit logs: dispatches GraphQL
- Authgear Portal → Admin API client: queries clients
- Authgear Portal → OAuth client form: edits client config
- Authgear Portal → Portal session state: persists UI state
- End user → Authgear Portal: administers project
- Authenticator service → Hooks and events: supports account events
- Auth routes → Localized templates: renders localized flows
- AuthUI flows → Image cloud storage: uploads images