Docs
Browse the references.
The Thoryn platform docs live in this repo as MDX recipes. Each one is versioned, reviewable, and pinned to the platform versions it was tested against. Pick a category below or jump to the blog for longer-form pieces.
158 documents
Product documentation
Long-form platform docs, authored in the repo and kept in sync with the code.
Get started
Choose your path — the managed sovereign SaaS on-ramp or a self-managed Helm deploy — and reach a first working sign-in against Thoryn.
Read
Quickstart: managed (sovereign SaaS)
Sign up, create your workspace, and register your first OAuth application on the EU-operated managed service — from zero to a first login.
Read
Quickstart: self-managed (Kubernetes + Helm)
Deploy the Thoryn platform to your own Kubernetes cluster with the Helm chart and verify every service comes up Ready — the happy path to a running stack.
Read
Account lockout, self-service unlock, and login analytics
Thoryn's brute-force protections for identity-service accounts: per-account password-failure lockout, verified-email self-service unlock, tenant-admin and operator unlock, and the read-only login-analytics surface — all grounded in the shipped code.
Read
Actions / Hooks: the hooks API
Integrate with the Actions/Hooks pipeline through the /api/v1/hooks management API — create a hook against a stage, send a test delivery, read delivery health, rotate the signing material, and verify the HMAC or Ed25519 detached-JWS signature on every delivery.
Read
Actions / Hooks: registration gate & user.created events
The registration.pre-create inline stage (augment or veto a sign-up) and the user.created async event stage — request/response contracts, fail modes, and how tenants configure them.
Read
Actions / Hooks: verifying the request signature
The HMAC-SHA256 request-signature scheme every hook stage uses — plus the optional Ed25519 detached-JWS mode verified against a published JWKS — the canonical string, copy-paste Node and Python verification, the replay window, and X-Thoryn-Hook-Stage routing.
Read
Add a federation member (external IdP)
Let a tenant's users sign in through their own Entra ID, Okta, Google Workspace, or generic-OIDC identity provider — the product-api federation-member management API and console wizard.
Read
Define a typed attribute schema for users and organizations
Tenant-defined, typed attribute definitions on product-api that type, validate, and render the user and organization metadata bags as opinionated forms instead of free JSON — plus a reusable validation service later stories enforce at the write path.
Read
Configure authentication for your workspace
The console's unified Authentication section and the customer-plane APIs behind it: enabling login methods, social login, enterprise SSO, and MFA; where the security settings live; the per-environment model that lets a sandbox hold and enforce a different authentication posture than production; and the tenant scope each area needs — grounded in the shipped code.
Read
Authorize with roles, permissions, and relationships (RBAC + FGA)
Two tenant-defined authorization models on product-api: coarse role→permission RBAC for tenant-wide gating, and relationship-based FGA (relation tuples + a Check API) for per-resource 'can user U do action A on resource R'.
Read
Brand your login page
Customize your tenant's hosted login page — logo, primary and background colours, corner radius, and light/dark theme — through the product-api login-experience API, including the WCAG-AA contrast guard and the exact validation rules, grounded in the shipped code.
Read
Claims in the token: permissions, org, and org_roles
Opt a client into product-api-resolved ID-token claims — RBAC permissions plus the active organization and its org-scoped roles — over the auto-wired claims-webhook path.
Read
Conditional access policies for an application
Per-application, first-match-wins conditional-access policies: gate sign-in on authentication strength, risk level, source IP, and session age, and act with allow, deny, or step-up. Where to configure them in the console, the customer-plane API, and exactly how the hub evaluates them.
Read
Consume the Events API
Poll GET /api/v1/events to replay your tenant's user, client, and federation lifecycle events forward from a cursor — the signature-free way to keep your own systems in sync. Covers auth and scope, the event object, cursor checkpointing for downtime-safe catch-up, type filtering, test vs live mode, and error handling — grounded in the shipped code.
Read
Customize transactional notification emails
Per-tenant (and per-locale) customization of identity-service's transactional emails — the magic-link, invitation, password-reset, security-alert, account-unlock, email-verification, and organization-invitation messages — through the customer-plane login-experience API, with an SSTI-safe placeholder allowlist and a locale fallback chain, all grounded in the shipped code.
Read
The directory user projection (read + CRUD)
Read and manage the environment-global cross-federation user directory in product-api — the record Thoryn materializes on first login for every federated or Thoryn-managed subject — with the real /api/v1/directory/users endpoints, the tenant + environment isolation rules, the external_id + metadata system-of-record fields, and how a pre-provisioned record reconciles cleanly on the user's first login.
Read
DSAR relying-party data return
Register a per-Application data-return endpoint so a GDPR Article 15 access bundle can fan in over your relying-party apps and include the subject's data held by them — the contract your endpoint implements, the signed request Thoryn sends, and the JSON response it expects.
Read
Entitlement access packages
Bundle tenant:* scopes into a named access package, let a subject request it (with optional approval), and have the granted scopes reach the access token through the same enrichment channel PIM uses — then auto-expire. Grounded in the shipped product-api entitlement surface and the hub scope-union customizer.
Read
Receive erasure signals: account-purged SETs, back-channel logout, and SCIM deprovisioning
How a relying party integrated with Thoryn is told when a tenant erases an end user (GDPR Art. 17): register an OpenID SSF receiver to get signed RISC Security Event Tokens (SET Push, RFC 8935) — account-purged on erase, account-disabled on the deactivate phase — receive OIDC Back-Channel Logout, and register a SCIM 2.0 endpoint to be deprovisioned by externalId. Includes the RISC event set, the exact SET shape, the subject→externalId assumption, and the Art. 17(2) boundary — a signal, not a guarantee.
Read
Integrate fine-grained authorization (FGA)
Author a relationship-based authorization model on product-api, write relation tuples, enforce at request time with the batch Check and reverse ListObjects APIs, read your own writes with the consistency token, export exhaustively for access reviews, and import an existing OpenFGA / Auth0 FGA graph.
Read
Guest B2B collaboration
Invite an external email into a tenant as a scoped, time-limited guest: mint a single-use magic-link token, let the invitee redeem it (token possession is the authorization), provision a cross-tenant membership, and have the recorded tenant:* scopes reach the guest's access token through the same enrichment channel PIM and entitlements use. Grounded in the shipped product-api guest surface and the hub scope-union customizer.
Read
Integrate an application (OAuth 2.0 / OIDC client)
Register an OAuth client for your app and wire it up with the standard Authorization Code + PKCE flow against the tenant issuer — the primary Thoryn SSO integration workflow.
Read
Author a custom login flow
The declarative, versioned login-flow model — stages, authenticators, requirements, and declarative conditions — and how a tenant authors one in the console flow editor: save a validated draft, then activate it. Covers the customer-plane API, the validation contract, the behaviour-neutral default flow, and the staged rollout of the execution engine.
Read
Migrate from Auth0 or Amazon Cognito
A step-by-step runbook for moving a user base off Auth0 or Amazon Cognito onto Thoryn using the turnkey vendor-export import endpoints — the export commands, the field mapping, an honest account of which credentials carry over, and cutover and rollback.
Read
Migrate your users to Thoryn
Move an existing user base off Auth0, Okta, Cognito, or Keycloak — bulk password-hash import, lazy trickle migration that verifies at first login, and federate-then-migrate coexistence, with an honest account of what carries across and what does not.
Read
Multi-factor authentication: enroll and verify
How Thoryn's identity-service enrolls and verifies second factors for the accounts it hosts — TOTP authenticator apps, passkeys (WebAuthn), SMS one-time codes, one-time backup codes, and last-resort recovery codes — plus the login-challenge routing, self-service recovery, and the headless credential channel. Grounded in the shipped code.
Read
OATH hardware tokens: import, assign, and lifecycle
How an administrator provisions physical OATH TOTP/HOTP hardware tokens in Thoryn's identity-service — bulk CSV import, assignment, deactivation, reassignment, deletion, and listing — plus how a hardware token is verified at the MFA challenge and why it takes precedence over software TOTP. Grounded in the shipped code.
Read
B2B Organizations
Model a tenant's own business customers as organizations with members and email invitations — the product-api Organizations management API.
Read
Organization SSO and the login gate
Attach an IdP connection to a B2B organization, verify its email domains over DNS-TXT, route matching users to that connection, just-in-time-provision members, and the tenant-membership login gate that lets invited members sign in.
Read
Pairwise subject identifiers (pseudonymous per-application sub)
Configure an OAuth client to receive a per-sector pseudonymous sub (OIDC Core 8.1 pairwise) so the same person is uncorrelatable across unrelated applications, and understand why switching an existing client re-keys its users.
Read
Just-in-time privileged elevation (PIM)
Grant a subject a time-bound, step-up-gated elevation to a tenant:* scope: define an eligibility, activate it (with optional approval), and have the active scope reach the access token through the enrichment channel — then auto-expire. Grounded in the shipped product-api PIM surface and the hub scope-union customizer.
Read
Pre-erasure veto callback: implementing a veto endpoint
How a relying party opts in as a veto client and implements the pre-erasure veto callback — the signed request/response contract, verifying the Thoryn signature, idempotency, retries, and the fail-closed guarantee that keeps a subject's data from being erased while your objection stands.
Read
Publish Terms of Use and Privacy Policy for an application
Version, publish, and activate an application's Terms of Use and Privacy Policy from the customer plane — a tenant admin API that proxies to identity-service's per-client legal-document store, gated on tenant:compliance.* and scoped to clients the tenant owns.
Read
Receive webhook events
Register a webhook endpoint, verify the X-Thoryn-Signature HMAC on each delivery, and read per-endpoint delivery attempts to answer 'is my endpoint healthy?' — the push twin of the pollable Events API. Grounded in the shipped webhook-endpoint CRUD, the shared signed-delivery sender, and the delivery-attempt read surface. Preview: today user.created is delivered best-effort at-most-once.
Read
Reset your test data
Wipe a selected sandbox environment's dataset in one call — the Stripe-style 'delete all test data' control — with the sandbox-target, confirmation, and audit safeguards that keep production data safe, grounded in the shipped code.
Read
Restrict logins by country (geo-blocking)
Configure a per-tenant country allowlist that gates Thoryn-managed credential logins — the three enforcement modes (off / warn / block), the customer-plane /api/v1/geo-policy API, the operator switches, and the self-lockout safeguards — grounded in the shipped code.
Read
Risk-based step-up on impossible travel
How identity-service responds to an impossible-travel sign-in: the per-tenant off/alert/step-up/block modes, the second-factor challenge for enrolled users, and the emailed one-time code that challenges users who have no second factor.
Read
Provision users and groups with SCIM 2.0
Auto-provision and deprovision users from a tenant's IdP over SCIM 2.0 — the identity-service /scim/v2/Users and /Groups endpoints, the bearer-token contract, attribute mapping, and the supported filter and PATCH surface.
Read
SIEM streaming export
Stream your tenant's security-relevant audit events to a SIEM endpoint (Sentinel, Splunk, Elastic) over authenticated HTTPS. Configure a sink, and every matching committed audit row fans out to it at-least-once with retry and a dead-letter queue — grounded in the shipped product-api SIEM surface and the audit-chain fan-out.
Read
User metadata and custom attributes
Attach arbitrary per-user data to Thoryn users through two independent JSON bags — an admin-controlled app_metadata and an end-user-editable user_metadata — with the real endpoints, the JSON-object + byte-cap constraints, and an honest account of the one path (admin-controlled app_metadata only) by which a selected key can reach an ID token.
Read
Operate Thoryn
How-to runbooks for running Thoryn: the shared-responsibility split between managed SaaS and self-managed, and the deploy / upgrade / backup-and-recovery guides — both delivery models on the identical Helm chart.
Read
Backup and recovery
What the chart backs up (Postgres dumps, OpenBao file-backend), and the vetted recovery procedures — forward-patch-only Flyway, the never-DROP-DATABASE rule, OpenBao unseal recovery, and Helm SSA field-ownership reclaim — summarised and linked to the authoritative runbooks.
Read
Deploy (self-managed)
The full self-managed deploy runbook: prerequisites, the required Helm values and why each fails loud, OpenBao init/unseal, DNS/TLS, first-boot Postgres + Flyway ordering, and a from-scratch verify — the depth the self-managed quickstart defers to.
Read
OpenBao raft HA + OTC KMS auto-unseal (production, gated)
The gated, default-off chart scaffold for the managed-OTC production OpenBao posture — integrated raft storage plus OTC/T-Cloud KMS auto-unseal via the tcloudpublic seal plugin — and the careful ops steps it deliberately leaves for a separately staging-validated cutover: bundling the plugin into the OpenBao image, the seal/unseal/raft-standby-join/seal-migration validation gate, and the Transit seal-OpenBao fallback.
Read
Production deploy pipeline (design)
How a from-scratch production deploy is made reproducible: the production values overlay, the required values and secrets it needs, the tag-triggered manually-approved pipeline, pre-flight and restore ordering, and post-deploy verification.
Read
Production go-live cutover runbook
The ordered, gated operational sequence to take Thoryn to production — numbered phases with entry and exit gates, a current-blocking-gates summary, and a per-phase rollback plan — synthesized from the reproducible-deploy audit, the trustTestIssuers flip-readiness assessment, and the monitoring / deploy-pipeline design ADRs. Honest about what exists vs. what is filed-but-unbuilt.
Read
Production readiness — reproducible-deploy audit
The authoritative pre-production checklist for oathy: every operator-set secret, one-time step, and deploy-ordering constraint that stands between a clean from-scratch `helm` deploy and a working environment — each classed fail-loud vs silent, mapped to its owning ticket, with the pre-cutover action.
Read
Tenant BYO-SMTP activation
Turn on per-tenant bring-your-own SMTP: what the chart provisions, how to activate an environment, how to verify the three outcomes that matter, and why rotating the credential-encryption key is destructive.
Read
Upgrade and rollback
Rolling upgrades via helm upgrade: the immutable image-SHA contract, forward-only Flyway migrations on boot, surge-rolling with tiered readiness probes, and rollback with helm rollback.
Read
Architecture guide
How the Thoryn identity platform is built — the identity-broker pattern, the four planes, and how they compose. The explanation annex to the product white paper.
Read
Delivery-model architecture
How the same artefacts run as an EU-operated managed service or self-managed on the customer's Kubernetes — underwritten by a rebuildable-from-git discipline: Helm for infra, Flyway for schema, config as code.
Read
Federation runtime
How the hub brokers sign-in to external identity providers — the FederationProvider dispatch, Vault-enveloped per-tenant credentials, product-api-owned discovery caches, outbox sync, and the stateless FED_TOKEN flow.
Read
Module map
Every module in the identity platform — the five servers, the federation-member connectors, and the shared core libraries and Spring Boot starters — plus the contributor extension points the starters expose.
Read
Multi-tenancy & the multi-issuer model
One hub deployment, many tenants — each tenant its own OIDC issuer with a dedicated signing key, isolated by the tnt claim and a trusted-issuer SSRF boundary.
Read
Token lifecycle
From pushed authorization request to signed token — the authorize/federation/token path, the claims-enrichment customizer chain, and ES256 signing via Vault/OpenBao Transit with per-tenant keys.
Read
Thoryn — The Sovereign Identity Platform
A multi-tenant SaaS CIAM and identity-broker platform, available as a managed sovereign service or self-managed. Product white paper.
Read
API reference
Generated reference for the Thoryn Customer-plane Management API (v1).
Read
AppGallery
Curated application-template gallery for pre-filled OAuth client registration.
Read
Applications
OAuth client registration and lifecycle — the convergence-target surface (create, patch, secret rotation with 24h overlap, token-usage observability).
Read
AttributeSchema
Tenant-defined, typed attribute definitions that type/validate/render the user and organization metadata bags as opinionated forms, plus curated templates an admin applies to bootstrap a schema (SSO-2543).
Read
Audit
Tenant-scoped audit-event query API.
Read
AuditEventExport
Audit-event CSV export for offline compliance processing.
Read
BotPolicy
Bot & abuse detection configuration (SSO-2614) — enable/disable Cloudflare Turnstile per environment; the site key is public, the secret is write-only (stored in Vault, never returned).
Read
CoAdmin
The CoAdmin resource.
Read
ComplianceReport
NIS2 / DORA compliance-evidence report generation and download.
Read
ConditionalAccessPolicy
The ConditionalAccessPolicy resource.
Read
Consent
The Consent resource.
Read
ConsentPurpose
The ConsentPurpose resource.
Read
Directories
The Directories resource.
Read
DirectoryAttributeMapping
The DirectoryAttributeMapping resource.
Read
DirectoryConnector
The DirectoryConnector resource.
Read
DirectoryGroupRoleMapping
The DirectoryGroupRoleMapping resource.
Read
DirectoryMembers
The DirectoryMembers resource.
Read
Dsar
GDPR Article 15 data-subject access requests (execute + fetch results).
Read
DsarReturnEndpoint
The DsarReturnEndpoint resource.
Read
Entitlement
Access packages — catalog, assignment requests, and approvals.
Read
EntraAppMigration
Microsoft Entra app-registration bulk import to Thoryn OAuth clients — read-only dry-run reconciliation report (SSO-1326).
Read
EntraCaMigration
Microsoft Entra Conditional-Access policy migration to tenant auth policies.
Read
Environment
Workspace environments (SSO-2410) — several long-lived sandboxes plus the one platform-managed production plane per workspace: list, create sandbox, rename, suspend/reactivate.
Read
ErasureRequest
The ErasureRequest resource.
Read
Events
Tenant-facing Events API — poll lifecycle events (user.*, client.*, federation.*) forward from a cursor; the signature-free twin of tenant webhooks.
Read
FederationConnectionTests
Connection tests for federation members (Microsoft Entra ID, Google Workspace, Okta) run during the attach wizard.
Read
FederationMembers
The FederationMembers resource.
Read
FgaCheck
The FgaCheck resource.
Read
FgaImport
The FgaImport resource.
Read
FgaListObjectsExport
The FgaListObjectsExport resource.
Read
FgaModels
The FgaModels resource.
Read
FgaTuples
The FgaTuples resource.
Read
GeoPolicy
The GeoPolicy resource.
Read
Guest
Guest invitations: invite, redeem, revoke, list.
Read
Hooks
Actions/Hooks — tenant-configured webhooks into the auth pipeline (register, list, update, delete; secret shown once on create).
Read
Impersonation
The Impersonation resource.
Read
ImpersonationPolicy
The ImpersonationPolicy resource.
Read
InvitationPolicy
The InvitationPolicy resource.
Read
Invitations
The Invitations resource.
Read
LegalDocuments
The LegalDocuments resource.
Read
LoginExperience
The LoginExperience resource.
Read
LoginFlow
The LoginFlow resource.
Read
LoginMethodPolicy
The LoginMethodPolicy resource.
Read
MeConsent
The MeConsent resource.
Read
MeLinkedIdentities
The MeLinkedIdentities resource.
Read
MeOrganizations
The MeOrganizations resource.
Read
MigrationSource
The MigrationSource resource.
Read
NamedLocation
The NamedLocation resource.
Read
OrgMembershipProjection
The OrgMembershipProjection resource.
Read
OrganizationAttributeSchema
The OrganizationAttributeSchema resource.
Read
OrganizationConnections
The OrganizationConnections resource.
Read
OrganizationDomains
The OrganizationDomains resource.
Read
OrganizationMemberRoles
The OrganizationMemberRoles resource.
Read
Organizations
B2B Organizations — the tenant's own customer companies (SSO-1897): org CRUD, membership, and email invitations (token shown once on invite).
Read
Permissions
RBAC permission catalog (SSO-1891).
Read
Pim
Privileged Identity Management — just-in-time role elevation with approval.
Read
PimEligibilityAdmin
PIM eligibility administration (SSO-1321) — define who may request elevation (create/list/read/revoke eligible assignments); gated on tenant:pim.admin.
Read
Policy
The Policy resource.
Read
RecordsOfProcessing
The RecordsOfProcessing resource.
Read
RiskEvents
Anomalous-login / risk-detection signals (impossible travel, new device, credential stuffing) — one severity-filterable, cursor-paginated stream for the admin risk dashboard (SSO-2143).
Read
Roles
RBAC roles and role-permission bindings (SSO-1891).
Read
ScimDeprovisionEndpoint
The ScimDeprovisionEndpoint resource.
Read
SecurityPolicy
The SecurityPolicy resource.
Read
Siem
SIEM audit-event streaming configuration.
Read
SsfPoll
The SsfPoll resource.
Read
SsfReceiver
The SsfReceiver resource.
Read
TenantAuditRetention
Per-tenant audit retention window configuration.
Read
TenantAuthenticationPolicy
Per-tenant authentication policy (MFA requirements, session rules).
Read
TenantCapabilities
Tenant capability families — self-service entitlement toggles.
Read
TenantIpRule
Tenant IP allow/deny rules enforced at the gateway.
Read
TenantProvisioning
The TenantProvisioning resource.
Read
TestDataWipe
The TestDataWipe resource.
Read
TokenClaims
Per-application token-claim enrichment configuration.
Read
TrustCenter
The TrustCenter resource.
Read
UserDirectory
The UserDirectory resource.
Read
UserImport
Bulk user import — synchronous batches and asynchronous jobs, with pre-hashed passwords carried over so migrated users sign in without a reset (SSO-1992).
Read
UserPermissions
Effective permission resolution per user (RBAC read model).
Read
UserRoles
User-to-role assignments (RBAC).
Read
Users
Tenant user management — CRUD plus lifecycle (suspend/reactivate/soft-delete), metadata, sessions/force-logout, unlock, password-reset-on-behalf, and risk-state (SSO-1884).
Read
WebhookClaimSchema
Webhook claim-schema registration for token enrichment.
Read
WebhookEndpoint
**Preview.** The WebhookEndpoint push-subscription API is live in preview: register an endpoint, subscribe it to catalog event types, receive signed (`X-Thoryn-Signature`) deliveries, and read each endpoint's recent delivery attempts. Delivery is currently wired for the `user.created` event on a best-effort (at-most-once) basis; full event-catalog coverage and at-least-once delivery hardening (retries, dead-letter) are still in progress. Tracked under SSO-1885.
Read
Configuration reference
Operator-facing reference for the oauthy.* configuration namespace and the infrastructure knobs a self-managed deployment sets.
Read
API gateway configuration
Generated reference for the oauthy.* configuration bound by API gateway.
Read
Authorization hub configuration
Generated reference for the oauthy.* configuration bound by Authorization hub.
Read
Federation members configuration
Generated reference for the oauthy.* configuration bound by Federation members.
Read
Identity service configuration
Generated reference for the oauthy.* configuration bound by Identity service.
Read
Infrastructure configuration
Generated reference for the operator-critical spring.* / env-var infrastructure knobs and the required deploy-time Helm values.
Read
Platform (shared libraries) configuration
Generated reference for the oauthy.* configuration bound by Platform (shared libraries).
Read
Product API configuration
Generated reference for the oauthy.* configuration bound by Product API.
Read
Security & compliance dossier
The trust model, threat model, and shared-responsibility split a security or compliance reviewer needs to assess Thoryn — grounded in code and ADRs.
Read
CI security guards
The build-time scripts/check-*.sh family that makes each security invariant in this dossier un-regressable — a regression fails the PR before it can merge.
Read
PII coverage matrix — DSAR + erasure completeness audit
Every personal-data-holding store across hub, identity-service, and product-api, mapped against the DSAR export fan-out and subject erasure — the completeness audit that gates any complete-GDPR claim (SSO-2505).
Read
Pre-production security posture + dependency audit
A pre-production security pass over oathy: pinned-dependency CVE review and the security-relevant deployment/config invariants, with an honest OK / GAP / UNKNOWN verdict per area and links to the tracking tickets.
Read
Privacy & compliance
Where personal data lives, GDPR access (Art. 15) and erasure (Art. 17), the multi-source DSAR fan-out, per-tenant retention, and NIS2 incident logging.
Read
Test mode: trustTestIssuers flip-readiness assessment
Evidence-based go/no-go for enabling per-tenant test mode (SSO-1887) by trusting test-issuer signatures at the resource servers. Current verdict: still NO-GO — the identity user-data-plane and login-mode blockers (S5a/S5b/S5c) have merged and the flip-wiring itself (SSO-2146) has now landed default-off (the gated property + cross-mode E2E across the three resource servers), so a test credential can no longer reach live user data; *enabling* the gate still waits on side-effect suppression (S5d/SSO-2157, SSO-2148), the audit tail, a live staging round-trip, and the product-owner go/no-go.
Read
GDPR shared-responsibility matrix
Who is controller and who is processor, and how each GDPR obligation splits between the managed sovereign SaaS and a self-managed deployment — the tenant is always the controller; Thoryn provides the tooling.
Read
SIEM and DSAR in test mode
Why the SIEM streaming surface is mode-partitioned but the DSAR (GDPR Article 15) surface is platform-live-and-blocked in test mode — the two flip-blocking decisions that close the last customer-plane gaps before trustTestIssuers flips.
Read
Signing & cryptographic custody
ES256 signing in Vault/OpenBao Transit (keys never leave the backend), per-tenant HMAC, version-prefixed identifiers, and the verifiable hash-chained audit trail.
Read
SSRF & outbound HTTP
How every outbound call to a tenant- or admin-influenced URL is guarded: OutboundUrlGuard / ReactiveOutboundUrlGuard, the older UrlSafetyValidator, and the SSRF-safe JWKS fetch.
Read
Tenant isolation
How Thoryn keeps thousands of tenants isolated on one deployment: the tnt claim, cross-tenant 404, the trusted-issuer SSRF boundary, per-tenant crypto, and tenant-never-in-URL.
Read
Token security
Refresh-token rotation with replay/family revocation, device-fingerprint binding, single-use codes with PKCE, DPoP/mTLS sender-constrained tokens, and RFC 9457 error hygiene.
Read
8 recipes
Quickstarts
Ship Hub-backed SSO in 5 minutes — one guide per framework.
ASP.NET 8 — Hub login with `Microsoft.AspNetCore.Authentication.OpenIdConnect`
Wire OAuth2 / OIDC into an ASP.NET 8 app via the official OpenIdConnect handler. Five steps, ~20 lines of config.
Read recipe
Django 5 — Hub login with `mozilla-django-oidc`
Wire OAuth2 / OIDC into a Django 5 app. Five steps, ~15 lines of settings.
Read recipe
Express — Hub login with `openid-client`
Add OIDC to an Express 4 / 5 app using the official Node OIDC library. ~40 lines of code.
Read recipe
Next.js — Hub-backed SSO in 5 minutes
Add OAuth 2.0 / OIDC login to a Next.js 15 App Router app via Hub. Five steps, ~30 lines of code.
Read recipe
Rails 7 — Hub login with `omniauth-openid_connect`
Wire OAuth2 / OIDC into a Rails 7 app via OmniAuth. Five steps, ~25 lines of config.
Read recipe
React SPA — Hub login with `oidc-client-ts`
Wire OAuth2 / OIDC into a React 19 + Vite SPA using the standard browser library. Auth code with PKCE, no client secret.
Read recipe
Spring Boot 3 — Hub login with Spring Security OAuth2
Add OAuth 2.0 / OIDC to a Spring Boot 3 web app via Spring Security 6's OAuth2 client. Five steps, ~10 lines of YAML.
Read recipe
Vue 3 — Hub login with `oidc-client-ts`
Wire OAuth2 / OIDC into a Vue 3 + Vite app. Auth code with PKCE, composable for the rest of the app.
Read recipe
11 recipes
Federation
Templates for Okta, Entra ID, Google Workspace, SAML, and more.
Add Thoryn Hub as a Custom OIDC connection in your existing Auth0 tenant
Customer keeps Auth0 as the user-facing IdP and adds Thoryn Hub as an upstream OIDC connection. The reverse of `auth0-as-source` — use it when migration is years away but EUDIW is needed today.
Read recipe
Add Thoryn Hub as an OIDC IdP in your existing Okta tenant
Customer keeps Okta as the user-facing IdP and adds Thoryn Hub as an upstream OIDC identity provider — the EUDIW + verifiable-credential gateway behind the Okta login. The reverse of `okta`.
Read recipe
Auth0 as a Hub federation source — migration overlay
Federate Hub to an existing Auth0 tenant during a migration window. Customers stay logged in via Auth0; Hub takes over gradually.
Read recipe
Generic OIDC IdP as a Hub federation member
Catch-all template for federating Hub to any OIDC-conformant IdP — public-cloud providers, regional IdPs, internal identity stacks.
Read recipe
Generic SAML 2.0 IdP as a Hub federation member
Federate Hub to any SAML 2.0 IdP — long-tail enterprise IdPs, custom corporate identity providers, ADFS, etc.
Read recipe
Google Workspace as a Hub federation member
Federate Hub to a Google Workspace tenant. Common at small-mid SaaS customers.
Read recipe
JumpCloud as a Hub federation member
Federate Hub to a JumpCloud directory. The simplest of the seven pre-built connectors — JumpCloud uses one global OAuth issuer, so only client-id and client-secret are needed.
Read recipe
Keycloak as a Hub federation member
Self-hosted shops federate their Keycloak realm into Hub via standard OIDC. Common at developer-heavy customers and EU public-sector orgs.
Read recipe
LinkedIn as a Hub federation member
Add LinkedIn social sign-in via OIDC. Two LinkedIn quirks shape the setup — email is a separate scope, sub is opaque per app.
Read recipe
Microsoft Entra ID (Azure AD) as a Hub federation member
Federate Hub to an Entra ID tenant. Most-common enterprise scenario in DACH and the UK.
Read recipe
Okta as a Hub federation member (OIDC)
Federate Hub to an Okta tenant. Okta authenticates the user; Hub issues the OAuth2 / OIDC tokens to your relying parties.
Read recipe
Long-form
Blog
Architecture deep-dives, migration notes, and compliance walk-throughs. Tracks the platform; written by the people shipping it.
19 recipes live in the repo today under apps/site/content/recipes/. The hosted reference at docs.thoryn.org is on the 2026 roadmap; until then, this index points at every shipped piece.