Hypothesis
Idea
Self-hosted alternative to hosted auth platforms — without telemetry, without third-party update calls
Open auth construction kit
Auth Fly
SSO. SDKs. Adapters. Take off.
2
protocols
5
repos
1
IdP session
0
tracking
Replace slide decks with logs, signed assertions, and a pre-flight checklist. The story is in the protocol.
Trajectory
From hypothesis to MVP
Architecture
2025 Q3
core / authkit / authkit-hanko split — provider-agnostic contracts before code
PoC live
2025 Q4
SAML 2.0 + OIDC sharing one signed IdP session, Hanko as credential backend
MVP in flight
2026 Q1+
Pre-flight security checklist, Supabase / custom Postgres backend, Console scaffolding
Roadmap
Next
SCIM, Audit logs, Organizations, MFA, Webhooks — staged in the open
2
Protocols live (SAML, OIDC)
5
Modules in the org
0
External telemetry calls
MIT
License everywhere
Capabilities
What Auth Fly ships
Security first
No telemetry, no third-party update calls. Hardening tracked publicly via a pre-flight checklist.
IdP core
SAML 2.0 IdP and OIDC Provider sharing one signed session cookie, Hanko-backed for the PoC.
Hosted UI
UI8Kit-based login, logout and error pages with embedded i18n and dark theme — served from your own origin.
Adaptive SDKs
One TypeScript core; thin adapters per provider and per language — start with Hanko today.
Journal
Recent flight log
Why Auth Fly: own your IdP, skip the telemetry
A self-hosted SSO construction kit, built around one principle: identity belongs on your own origin, with no third-party update channels in the critical path.
One IdP session for SAML and OIDC
How a single signed idp_session cookie bridges SAML Service Providers and OIDC Relying Parties on the same Identity Provider — and why it stays simple.
SAML 2.0 in ~600 lines of Go: what we kept, what we cut
A walk through the Auth Fly SAML implementation: AuthnRequest parsing, ACS pinned to SP config, XMLDSig with SHA-256 and RS256 — and the hardening still on the runway.
OIDC done minimal: code flow, JWKS, and the road to PKCE
What a small OIDC provider looks like: Discovery, /authorize, one-shot codes, /token with no-store, /userinfo, /jwks — and the hardening list before public clients.
Modules
Open building blocks
Active
AuthKit TS
TypeScript core for browser auth flows, with thin per-provider adapters.
Browser SDK core
Active
OIDC Hanko
Hanko packaged as the PoC credential backend for Auth Fly.
Credential backend
Active
UI8Kit
Component library that fully replaces Hanko Elements across the hosted UI.
UI libraryReplace slide decks with logs, signed assertions, and a pre-flight checklist. The story is in the protocol.
— Auth Fly engineering principle
Follow