fx-auth · Identity & Access
fx-auth is an authentication server you host yourself: set it up once, connect all applications. Ten login methods from password to passkey, one signed token, one permission model — and your identities stay where they are.
The problem
Login, password reset, 2FA — redeveloped in every project. And with it, every time: a separate user table, separate password rules, a separate vulnerability.
Active Directory, customer database, Google accounts, machine tokens — the same person exists four times, permissions drift apart.
MFA, passkeys, SSO, audit evidence: what is missing today gets retrofitted expensively later — per application, again and again.
The solution
Password, passkey/Face ID, OIDC, NFC token, service accounts — every path ends in the same signed JWT with the same permission model.
A central login usually means: migrate all accounts. With fx-auth it means: write a plugin. AD, your own database, legacy systems — connect instead of relocate.
Token validation runs locally inside your application, with no round trip to the auth server. Permissions you can show in an audit: one typed triple model for everything.
Built like a product, not like a project
Standards instead of homegrown solutions: WebAuthn/FIDO2, OIDC, OAuth2 + PKCE, JWT ES256/RS256, Argon2, refresh token rotation with theft detection.
The Keycloak question
Keycloak can do almost everything — and is its own operations project in return. If your team needs a login and not an identity department, that is the wrong order of magnitude.
Self-hosted with source code, no per-user pricing, no vendor lock-in.
Next step
Sign-in is the moment your users trust you for the first time. Let's walk through how your logins become one in an architecture call — answer within one business day.