The Thoryn platform
One platform for customer identity
Authentication, user management, and authorization as building blocks on one API — running on infrastructure that never leaves the EU.
Building blocks
Compose the identity flows your product needs
Start with one block and add the rest as you grow. Each has a page detailing what ships, with a link to its docs.
Enterprise SSO
Federate Okta, Entra ID, Google Workspace, and long-tail SAML or OIDC providers. PKCE and PAR are on by default.
Learn moreSocial login
Let consumers sign in with Google, GitHub, or Apple, alongside email and password.
Learn morePasswordless & MFA
Offer passkeys, magic links, magic codes, and TOTP or hardware tokens. Step up when risk demands it.
Learn moreUser management
A directory for your users with profiles, custom attributes, and linked identities.
Learn moreOrganizations (B2B)
Model business customers as organizations with their own members, roles, domains, and SSO connections.
Learn moreAuthorization (RBAC + FGA)
Combine roles with fine-grained, relationship-based access checks over the same policy engine.
Learn moreDirectory sync (SCIM)
Provision and de-provision users from your customers' directory with SCIM 2.0.
Learn moreActions & Hooks
Run custom logic in the login flow and stream every event to your own systems.
Learn moreAudit & compliance
Tamper-evident audit logs, SIEM streaming, DSAR return, and consent records ship in the box.
Learn moreMigration
Import users, password hashes, and profiles from Auth0 or Cognito with no forced reset.
Learn more
Sovereign by default
Your users' data never leaves the EU
Sovereignty is not a tier or an add-on. It is how the platform is built and where it runs.
EU-only residency
Every request, key, and log stays on EU-only infrastructure. Data does not leave the region.
No CLOUD Act exposure
Dutch incorporation and EU hosting keep your data outside US CLOUD Act reach.
NIS2 and DORA-ready
Controls map to NIS2 and DORA, with evidence you can hand to auditors.
Keys in Vault, not the app
ES256 signing keys are custodied in Vault and OpenBao, never in the application.
Developer-first
One API, one CLI, no lock-in
Wire your first login this afternoon, then automate the rest from your own toolchain.
One REST API
A single /api/v1 surface covers every capability, with generated reference docs.
The thoryn CLI
Script tenants, clients, and users from the thoryn command-line tool.
Actions & Hooks
Extend login with your own code and subscribe to the events you care about.
Open standards
Built on OAuth 2.0, OIDC, PKCE, PAR, and DPoP. No proprietary protocol.
Standards
Built on open standards, not a proprietary stack
Every flow maps to a published specification you can audit against.
| Specification | Role |
|---|---|
| RFC 6749 — OAuth 2.0 | Authorization framework |
| OpenID Connect Core 1.0 | Federation and ID tokens |
| RFC 7636 — PKCE | Public-client code protection |
| RFC 9126 — Pushed Authorization Requests | Front-channel request integrity |
| RFC 8628 — Device Authorization Grant | Input-constrained device login |
| RFC 9449 — DPoP | Sender-constrained tokens |
| RFC 7644 — SCIM 2.0 | Directory provisioning |
| RFC 7517 — JSON Web Key Set | Current and historical JWKS |
| FIPS 186-5 — ECDSA (P-256) | ES256 signature primitive |
Ready to build on the platform?
Create an account and wire your first login, or talk to us about a pilot.