Skip to content

For developers

Wire your first login this afternoon.

One /api/v1 surface for every capability, standard OAuth 2.0 / OIDC, and a quickstart for your framework. There is no proprietary client to learn.

Get startedRead the docs

One REST API

Every capability behind one /api/v1 surface.

Users, clients, federation, organizations, authorization, and audit share one base URL, camelCase JSON, and OAuth 2.0 bearer tokens. Errors are RFC 9457 problem-details. The reference is generated from the OpenAPI spec, so it never drifts from the code.

Register an OAuth application

POST /api/v1/applications
curl -X POST https://api.thoryn.org/api/v1/applications \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "displayName": "Acme Portal",
    "redirectUris": ["https://app.acme.example/login/oauth2/code/thoryn"],
    "scopes": ["openid", "profile", "email", "offline_access"],
    "grantTypes": ["authorization_code", "refresh_token"],
    "clientType": "confidential"
  }'

The client secret comes back once

201 Created
{
  "clientId": "app-3f9c1a20b7e4",
  "clientSecret": "shown-once-store-it-now",
  "createdAt": "2026-07-16T09:30:00Z",
  "displayName": "Acme Portal",
  "redirectUris": ["https://app.acme.example/login/oauth2/code/thoryn"],
  "scopes": ["openid", "profile", "email", "offline_access"],
  "grantTypes": ["authorization_code", "refresh_token"],
  "status": "active"
}

SDKs — coming soonGenerate a typed client from the OpenAPI spec today. First-party SDKs are on the way.

Browse the API reference

The thoryn CLI

Script the platform from your terminal.

The thoryn CLI drives the same API with bearer tokens. Tenants, clients, users, federation, and audit are all scriptable — in CI, in a Makefile, or by hand.

Explore the CLI
terminal
thoryn users create \
  --email ada@acme.example \
  --send-invite

thoryn audit tail --follow

Quickstarts

Copy-pasteable login for your framework.

Each quickstart wires OAuth 2.0 / OIDC into one framework with its standard library — no Thoryn-specific client. Five steps take you from an empty project to a working sign-in.

Browse all recipes

Extend the pipeline

Shape login, then stream what happens next.

Run your own code inside the login flow, and consume a typed stream of everything the platform does.

Actions & Hooks

Insert custom logic into the login pipeline to enrich tokens, gate sign-in, or call your own service. Hook requests are signed and verifiable.

Read the Actions & Hooks guide

Events API

Pull a typed, cursor-paginated stream of logins, user changes, and admin actions to feed your own analytics, SIEM, or automation.

Consume the Events API

Environments

Build in a sandbox, not in production.

A workspace holds sandbox environments alongside production, provisioned from the console or scripted through the API. Build and test integrations away from your live configuration.

Coming soon

Full test-mode token isolation is on the way. Until it ships, keep test integrations on a separate sandbox environment.

Ready to wire it up?

Create a workspace and register your first application in minutes.

Get startedRead the docs