OAuth Server

Be the provider, not the client

"Sign in with your product" is a standards-compliant OAuth 2.1 and OpenID Connect issuer you turn on — not a quarter of work and a security review you have to schedule

Start for free Documentation

Auth/OAuth applications · production⌘K

Applications

Clients allowed to request tokens from your issuer.

https://acme.nulvless.coNew application

Name	Client ID	Type	Grant types	Created
AAAcme Analytics	acme_an_7b31d0	confidential	authorization_coderefresh_token	5 months ago
DBDeploy Bot	deploy_2f19ac	confidential	client_credentials	2 months ago
FCField CLI	field_be40d5	public	authorization_coderefresh_token	3 weeks ago
LSLedger Sync	ledger_c07a91	confidential	client_credentials	6 days ago

Your ecosystem

Third parties, internal tools and AI agents all integrate the same way, against the same issuer

Auth/Server⌘K

Server

Your project as a standards-compliant issuer.

https://acme.nulvless.coenabled

OAuth serverIssue tokens for third-party clients.

Dynamic registrationLet clients register themselves at /oauth/register.

Endpoints

/.well-known/openid-configuration

/.well-known/jwks.json

/oauth/authorize

/oauth/token

/oauth/userinfo

/oauth/register

/oauth/revoke

/oauth/introspect

Capabilities

authorization_coderefresh_tokenclient_credentialsS256openidprofileemailphone

Turn the server on and the discovery document, JWKS and every endpoint go live together

Applications

Register clients, rotate secrets and set redirect URIs

Consent screen

Your name, your logo, the exact scopes being asked for

Dynamic registration

Let clients register themselves when that is what you want

Scoped tokens

Third-party tokens carry a subset of what the user actually holds

The standard, in full

Not a subset that works with one library. The endpoints, the metadata and the signatures a compliance review looks for

OIDC discovery
.well-known/openid-configuration, always in sync with your settings
JWKS
Published keys with rotation that does not break live tokens
PKCE
Required for public clients, because it should be
Grant types
Authorization code, refresh token and client credentials

Requests

Every call the platform served, as it happened.

2xx4xx5xx

Time	Method	Status	Source	Path	Message
12:04:11.204	POST	200	gateway	/auth/signin	session issued
12:04:10.881	GET	200	gateway	/.well-known/jwks.json	cached
12:04:09.117	POST	401	gateway	/auth/signin	invalid credentials
12:04:08.640	POST	200	oauth	/oauth/token	authorization_code exchanged
12:04:07.019	POST	429	gateway	/auth/signin	rate limit exceeded
12:04:05.552	POST	502	functions	/functions/webhook-relay	upstream unavailable
12:04:04.238	GET	200	gateway	/auth/session	session verified
12:04:02.907	POST	202	notifications	/notifications/send	email queued · email-otp-verification

Token exchanges show up in the request trail with the application that made them

Staying in control

Being the issuer means being able to shut a door immediately

Redirects

Where the platform is allowed to send a user back to.

Site URL · https://acme.comAdd URL

https://acme.com/auth/callback

https://app.acme.com/auth/callback

https://*.preview.acme.com/auth/callbackwildcard

http://localhost:3000/auth/callback

Anything not on this list is rejected before a token is ever issued.

Per-app revocation

Kill one integration without touching the others

Token introspection

Ask the issuer whether a token is still good

Consent history

What each user approved, when, and what they have since withdrawn

Lifetimes

Access and refresh token windows set per application

Discovery, from the first minute

Every endpoint an OIDC client expects is published and signed. Anything that speaks the standard can integrate without you writing a line for it.

oauth-server.ts

curl "$NULVLESS_URL/.well-known/openid-configuration"

Keep going

Authorization

The scopes an application can ask for

Authentication

How the user proves who they are first

Observability

Every token issued, in the trail

             %+[/0=       
            #{<&*}>%      
         +    ]\1$#{<&    
       #{<&*    [/0=]\1$  
     [/0=]\1$     }>%+[/0=
   {<&*}>%+         {<&*}>
 /0=]\1$#          0=]\1$#
&*}>%+[          &*}>%+[/ 
\1$#{<         =]\1$#{<   
+[/0=]\1     *}>%+[/0     
  *}>%+[/0    $#{<&       
    #{<&*}>%    =         
      ]\1$#{<&            
        [/0=]\

One platform, from your first user

Focus on your product. We handle identity infrastructure

Start for free Read the docs

What you would have built

Six areas, every one of them a project of its own.

Authenticationpasswords, providers, MFA, sessions
AuthorizationRBAC, scopes, per-resource grants
OAuth serverOIDC discovery, JWKS, PKCE
Edge functionsDeno runtime, deploys, rollback
Notificationstemplates, providers, delivery logs
Observabilitymonitoring, audit trail, query

Roughly9 engineer-months · $135,000You start at$0