Get started

Thoryn is a multi-tenant OAuth 2.0 / OpenID Connect identity broker and CIAM platform. It brokers sign-in across a tenant's own users and any external identity provider, issues standards-compliant tokens, and governs access with role- and relationship-based authorization. This section gets you from nothing to a first working sign-in as fast as the product allows, then hands off to the guides and reference for depth.

There are two ways to run Thoryn, on the same artefacts — the same container images, the same Helm chart, the same configuration schema. What differs is who operates the servers, not what the servers are (see Delivery-model architecture). Pick the path that matches how you consume the platform:

Choose your path

	Managed quickstart	Self-managed quickstart
What it is	The EU-operated sovereign SaaS — Thoryn runs the servers	The identical distribution on your Kubernetes, via the Helm chart
You start by	Signing up on the Thoryn website	Deploying the chart to a cluster you control
Who operates the infra	Thoryn	You
Who configures tenants / clients / policy	You (self-service console + API)	You (the same console + API)
Best when	You want a fast start and sovereign hosting with no ops burden	You need air-gap, full data residency, or dedicated infrastructure
First success is	Your workspace created + your first application registered + a login	The platform deployed and every service reporting Ready

The customer plane — tenant configuration, OAuth-client registration, federation, RBAC / FGA, and audit — is self-service in both models. Once the servers are running (whether Thoryn or you run them), the configuration workflow is identical, so the Integrate an application guide and the API reference apply unchanged to both.

What you will have at the end

• Managed: a workspace (your tenant), a registered OAuth client, and a browser sign-in that completes the Authorization Code + PKCE flow. Continue with Integrate an application.
• Self-managed: a running Thoryn stack (hub, product-api, api-gateway, identity-service, plus Postgres, Redis, and the OpenBao secrets backend) with a reachable OIDC discovery document. Continue with the same integration guide, pointed at your own issuer.

Where to go next

• Integrate an application — register an OAuth client and drive the OIDC flow. The primary integration workflow, and the shared next step for both paths.
• Claims in the token — enrich the ID token with permissions, org, and org_roles.
• B2B Organizations — model your own business customers as organizations with members and invitations.
• API reference — the generated customer-plane management API, including the scope catalog.
• Configuration reference — the oauthy.* namespace and the infrastructure knobs a self-managed deploy sets.
• Product white paper and Architecture guide — the explanation-quadrant context behind everything above.