A dedicated authentication API: accounts, sessions, second factors and client applications, with ES256 tokens other services verify through a JWKS. Built on Axum, PostgreSQL, Redis and NATS.
Auth API owns the whole account lifecycle - registration, email verification, sign-in, password reset and email change - and issues short-lived ES256 access tokens backed by rotating refresh tokens. Resource servers verify tokens offline with the published JWKS; nothing else needs to call it on every request.
Security is the design constraint rather than a feature list: sign-in answers never reveal whether an account exists, sensitive changes require a recent re-authentication, second factors cannot be bypassed or brute-forced, a replayed refresh token revokes its whole session, and production refuses to start with a configuration that disables any of it. The security model describes each control and the tests that pin it.
| Area | Capabilities |
|---|---|
| Accounts | Registration, email verification, sign-in by email or username, password reset, email change confirmed on both addresses, account deletion |
| Tokens | ES256 access tokens, rotating refresh tokens with replay detection, absolute session lifetime, JWKS with zero-downtime key rotation |
| Second factors | TOTP and email codes, recovery codes, replay guard, per-challenge and per-account budgets |
| Client applications | Registered clients, device authorization (RFC 8628), authorization code with PKCE (RFC 7636, RFC 8252), per-client scopes and session limits |
| Sessions | Per-device listing and revocation, re-authentication for sensitive actions |
| Protection | Sliding-window rate limits per client (IPv6 per /64), account lockout, CAPTCHA, trusted-proxy address resolution |
| Records | Append-only audit log partitioned by month, readable by each user; durable domain events on NATS JetStream |
| Localization | English and French emails |
To develop: Rust (2024 edition), Docker with Compose, GNU Make - see prerequisites.
To deploy: a server with Docker and a PostgreSQL and Redis reachable from it - see the Deployment Guide. NATS ships in the compose file.
git clone <repository-url> auth-api
cd auth-api
make devThe API serves at http://localhost:3000, and Mailpit catches emails at
http://localhost:8025. Every port is bound to loopback.
| Task | Command |
|---|---|
| Run the full quality gate | make test-infra-up && make ci |
| Register a client application | auth-api --register-client <id> --name <name> [--primary] |
| Build a release bundle | make release VERSION=x.y.z |
All commands are in commands; routes in routes and the generated OpenAPI document.
| Document | Contents |
|---|---|
| Developer Guide | Prerequisites, commands, quality gate, release, configuration, routes, schema, security model |
| Deployment Guide | Secrets, database, API and Nginx deployment, updates, operations runbook |
CHANGELOG.md |
Changes per release, breaking changes and upgrade notes |
LICENSE |
MIT license terms |
Distributed under the MIT License. See LICENSE for details.
Copyright (c) 2026 Lucas Fagioli.