How occupysaas/zeroauthy works
zeroauthy is a self-hostable Auth0-compatible identity server, with a Vue admin console and pluggable storage. The main user flow starts at an SDK or browser, enters the HTTP server, resolves authorization and login, authenticates a database or federated identity, and returns OAuth/OIDC tokens; hosted login, MFA, consent and organization context support that flow. The console separately manages tenant resources through the Management API. The README documents broad capabilities, but several implementations were not sampled, so their internal wiring is not inferred here.
Main entry points: open.go Storage backend · server.go HTTP server · handlers.go Authorization flow · client.ts Console API client
Components 25
Server runtime
- HTTP server
internal/server/server.go - App wiring
internal/app/app.go - Storage backend
internal/storage/open.go - Signing keys
internal/keys/manager.go
Identity flows
- Authorization flow
internal/authz/handlers.go - Hosted login
internal/hostedlogin/service.go - Database identity
internal/identity/database.go - Federated login
internal/federation/service_flow.go - MFA service
internal/mfa/service.go - OAuth handlers
internal/oauth/handlers.go - OIDC endpoints
internal/oidc/handlers.go
Management
- Management API
internal/mgmt/clients.go
Tenant operations
- Actions engine
internal/actions/engine.go - Email service
internal/email/service.go - Custom domains
internal/customdomain/service.go - Event delivery
internal/eventstream/worker.go - Log delivery
internal/logstream/worker.go
Admin console
- Console app
console/src/main.ts - Console API client
console/src/api/client.ts - Console authentication
console/src/auth/auth.ts - Actions screens
console/src/pages/actions/Editor.vue - Logs screens
console/src/pages/logs/LogsList.vue - Stream screens
console/src/pages/event-streams/StreamEdit.vue
Other components
- Auth SDK
- User browser
Connections 28
- Auth SDK → HTTP server: requests auth
README.md - User browser → HTTP server: uses login
README.md - HTTP server → Authorization flow: routes authorization
internal/server/server.go - HTTP server → OAuth handlers: routes API
internal/server/server.go - HTTP server → OIDC endpoints: routes OIDC
internal/server/server.go - HTTP server → Hosted login: serves login
- Authorization flow → Hosted login: starts login
internal/authz/handlers.go - Authorization flow → Database identity: authenticates users
- Authorization flow → Federated login: dispatches federation
- Authorization flow → MFA service: uses MFA
- OAuth handlers → Signing keys: mints tokens
- OIDC endpoints → Signing keys: uses signing keys
internal/oidc/handlers.go - App wiring → Storage backend: opens store
internal/app/app.go - App wiring → HTTP server: assembles server
- Authorization flow → Storage backend: reads state
- Management API → Storage backend: manages resources
internal/mgmt/clients.go - Console app → Console API client: creates client
console/src/main.ts - Console app → Console authentication: creates auth
console/src/main.ts - Console authentication → Console API client: supplies token
console/src/main.ts - Console API client → Management API: calls API
- Actions screens → Console API client: manages actions
- Logs screens → Console API client: queries logs
- Stream screens → Console API client: manages streams
- Actions engine → Storage backend: persists executions
internal/actions/engine.go - Event delivery → Storage backend: loads streams
internal/eventstream/worker.go - Log delivery → Storage backend: loads configuration
internal/logstream/worker.go - Email service → Storage backend: reads tenant config
internal/email/service.go - Custom domains → Storage backend: loads domain state
internal/customdomain/service.go