# thunder-id/thunderid architecture

> Architecture diagram of the GitHub repository thunder-id/thunderid, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/thunder-id/thunderid
- Repository: https://github.com/thunder-id/thunderid

## Overview

ThunderID is an IAM runtime for human, agent, and machine identities. A typical journey begins with an application or user request, enters the server’s authentication and flow-execution layers, and runs configured steps such as passkey, OTP, federation, or consent before producing an authenticated session or OAuth/OIDC token. Separate capabilities cover authorization, identity administration, and decentralized credentials. The README documents these product branches; the supplied source excerpts mainly show frontend route resolution and flow-editor drag/drop, so detailed backend call wiring is not established here.

Main entry points: [`backend/internal/authn/service.go`](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/service.go) (Authentication), [`backend/internal/flow/flowexec/engine.go`](https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/flowexec/engine.go) (Journey execution), [`backend/cmd/server/main.go`](https://github.com/thunder-id/thunderid/blob/main/backend/cmd/server/main.go) (IAM server), [`backend/internal/authz/service.go`](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authz/service.go) (Authorization)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_journeys["Identity journeys"]
  node_flowexec["Journey execution<br/>[engine.go]"]
  node_flowgraph["Journey graph<br/>[executor.go]"]
  node_flowconfig["Journey definitions<br/>[service.go]"]
  node_authn["Authentication<br/>[service.go]"]
  node_passkey["Passkeys<br/>[service.go]"]
  node_federation["Federated login<br/>[service.go]"]
  node_consent["User consent<br/>[service.go]"]
  node_session[("Journey session<br/>[service.go]")]
end

subgraph group_protocols["Identity protocols"]
  node_oauth["OAuth and OIDC<br/>[service.go]"]
  node_openid["Credential issuance<br/>[handler.go]"]
  node_presentation["Credential verification<br/>[service.go]"]
end

subgraph group_governance["Access governance"]
  node_authz["Authorization<br/>[service.go]"]
  node_authzengine["Policy engines<br/>[engine.go]"]
  node_consentmgmt["Consent management<br/>[service.go]"]
end

subgraph group_identity["Identity administration"]
  node_entities["Identity entities<br/>[service.go]"]
  node_agents["Agent identities<br/>[service.go]"]
  node_groups["Groups and OUs<br/>[service.go]"]
end

subgraph group_runtime["Runtime and design"]
  node_server["IAM server<br/>[main.go]"]
  node_connections["Identity connections<br/>[service.go]"]
  node_design["Journey presentation<br/>[service.go]"]
  node_floweditor["Journey editor"]
end

node_user(("User or agent"))
node_application(("Application or API"))
node_credentialwallet(("Credential wallet"))

node_user -->|"starts journey"| node_server
node_application -->|"requests access"| node_server
node_server -->|"dispatches journey"| node_flowexec
node_flowexec -->|"executes graph"| node_flowgraph
node_flowexec -->|"stores session state"| node_session
node_flowconfig -->|"defines journeys"| node_flowgraph
node_authn -->|"supports passkeys"| node_passkey
node_authn -->|"supports federation"| node_federation
node_authn -->|"handles consent"| node_consent
node_application -->|"uses OAuth/OIDC"| node_oauth
node_oauth -->|"issues tokens"| node_application
node_credentialwallet -->|"requests issuance"| node_openid
node_openid -->|"issues credentials"| node_credentialwallet
node_credentialwallet -->|"presents credentials"| node_presentation
node_authz -->|"evaluates access"| node_authzengine
node_authz -->|"uses consent"| node_consentmgmt
node_user -->|"administers identity"| node_entities
node_user -->|"administers agents"| node_agents
node_entities -->|"supports membership"| node_groups
node_connections -->|"configures providers"| node_federation
node_floweditor -.->|"edits journeys"| node_flowconfig
node_design -->|"provides themed UI"| node_user

click node_server "https://github.com/thunder-id/thunderid/blob/main/backend/cmd/server/main.go"
click node_flowexec "https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/flowexec/engine.go"
click node_flowgraph "https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/core/executor.go"
click node_flowconfig "https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/mgt/service.go"
click node_authn "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/service.go"
click node_passkey "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/passkey/service.go"
click node_federation "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/oauth/service.go"
click node_consent "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/consent/service.go"
click node_session "https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/session/service.go"
click node_oauth "https://github.com/thunder-id/thunderid/blob/main/backend/internal/oauth/oauth2/token/service.go"
click node_openid "https://github.com/thunder-id/thunderid/blob/main/backend/internal/openid4vci/handler.go"
click node_presentation "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/openid4vp/service.go"
click node_authz "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authz/service.go"
click node_authzengine "https://github.com/thunder-id/thunderid/blob/main/backend/internal/authz/engine/engine.go"
click node_entities "https://github.com/thunder-id/thunderid/blob/main/backend/internal/entity/service.go"
click node_agents "https://github.com/thunder-id/thunderid/blob/main/backend/internal/agent/service.go"
click node_groups "https://github.com/thunder-id/thunderid/blob/main/backend/internal/group/service.go"
click node_consentmgmt "https://github.com/thunder-id/thunderid/blob/main/backend/internal/consent/service.go"
click node_connections "https://github.com/thunder-id/thunderid/blob/main/backend/internal/connection/service.go"
click node_design "https://github.com/thunder-id/thunderid/blob/main/backend/internal/design/resolve/service.go"
click node_floweditor "https://github.com/thunder-id/thunderid/blob/main/frontend/packages/configure-flows/src/hooks/useDragDropHandlers.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_flowexec,node_flowgraph,node_flowconfig,node_authn,node_passkey,node_federation,node_consent,node_session,node_user toneBlue
class node_oauth,node_openid,node_presentation toneAmber
class node_authz,node_authzengine,node_consentmgmt,node_application toneMint
class node_entities,node_agents,node_groups toneRose
class node_server,node_connections,node_design,node_floweditor,node_credentialwallet toneIndigo
```

## Components

### Identity journeys

- [Journey execution](https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/flowexec/engine.go): `backend/internal/flow/flowexec/engine.go`
- [Journey graph](https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/core/executor.go): `backend/internal/flow/core/executor.go`
- [Journey definitions](https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/mgt/service.go): `backend/internal/flow/mgt/service.go`
- [Authentication](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/service.go): `backend/internal/authn/service.go`
- [Passkeys](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/passkey/service.go): `backend/internal/authn/passkey/service.go`
- [Federated login](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/oauth/service.go): `backend/internal/authn/oauth/service.go`
- [User consent](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/consent/service.go): `backend/internal/authn/consent/service.go`
- [Journey session](https://github.com/thunder-id/thunderid/blob/main/backend/internal/flow/session/service.go): `backend/internal/flow/session/service.go`

### Identity protocols

- [OAuth and OIDC](https://github.com/thunder-id/thunderid/blob/main/backend/internal/oauth/oauth2/token/service.go): `backend/internal/oauth/oauth2/token/service.go`
- [Credential issuance](https://github.com/thunder-id/thunderid/blob/main/backend/internal/openid4vci/handler.go): `backend/internal/openid4vci/handler.go`
- [Credential verification](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authn/openid4vp/service.go): `backend/internal/authn/openid4vp/service.go`

### Access governance

- [Authorization](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authz/service.go): `backend/internal/authz/service.go`
- [Policy engines](https://github.com/thunder-id/thunderid/blob/main/backend/internal/authz/engine/engine.go): `backend/internal/authz/engine/engine.go`
- [Consent management](https://github.com/thunder-id/thunderid/blob/main/backend/internal/consent/service.go): `backend/internal/consent/service.go`

### Identity administration

- [Identity entities](https://github.com/thunder-id/thunderid/blob/main/backend/internal/entity/service.go): `backend/internal/entity/service.go`
- [Agent identities](https://github.com/thunder-id/thunderid/blob/main/backend/internal/agent/service.go): `backend/internal/agent/service.go`
- [Groups and OUs](https://github.com/thunder-id/thunderid/blob/main/backend/internal/group/service.go): `backend/internal/group/service.go`

### Runtime and design

- [IAM server](https://github.com/thunder-id/thunderid/blob/main/backend/cmd/server/main.go): `backend/cmd/server/main.go`
- [Identity connections](https://github.com/thunder-id/thunderid/blob/main/backend/internal/connection/service.go): `backend/internal/connection/service.go`
- [Journey presentation](https://github.com/thunder-id/thunderid/blob/main/backend/internal/design/resolve/service.go): `backend/internal/design/resolve/service.go`
- [Journey editor](https://github.com/thunder-id/thunderid/blob/main/frontend/packages/configure-flows/src/hooks/useDragDropHandlers.ts): `frontend/packages/configure-flows/src/hooks/useDragDropHandlers.ts`

### Other components

- **User or agent**
- **Application or API**
- **Credential wallet**

## Connections

- User or agent → IAM server: starts journey
- Application or API → IAM server: requests access
- IAM server → Journey execution: dispatches journey
- Journey execution → Journey graph: executes graph
- Journey execution → Journey session: stores session state
- Journey definitions → Journey graph: defines journeys
- Authentication → Passkeys: supports passkeys
- Authentication → Federated login: supports federation
- Authentication → User consent: handles consent
- Application or API → OAuth and OIDC: uses OAuth/OIDC
- OAuth and OIDC → Application or API: issues tokens
- Credential wallet → Credential issuance: requests issuance
- Credential issuance → Credential wallet: issues credentials
- Credential wallet → Credential verification: presents credentials
- Authorization → Policy engines: evaluates access
- Authorization → Consent management: uses consent
- User or agent → Identity entities: administers identity
- User or agent → Agent identities: administers agents
- Identity entities → Groups and OUs: supports membership
- Identity connections → Federated login: configures providers
- Journey editor → Journey definitions: edits journeys
- Journey presentation → User or agent: provides themed UI