# theAuth

> Open-source auth for AI agents and humans. Agent identity with scoped permissions and delegation chains, an MCP OAuth 2.1 authorization server, passkeys, SSO and SCIM. MIT licensed. Built by GLINCKER, the open-source division of GLINR STUDIOS.

theAuth is a library you run against your own database, with SDKs for TypeScript, Go and Python. Every page on theauth.dev has a Markdown twin: append `index.md` to the page URL (for example https://theauth.dev/compare/auth0/index.md). The whole site as one Markdown file is at https://theauth.dev/llms-full.txt.

## Key facts

- Name: theAuth (written exactly like this). Package: `@glinr/theauth` on npm. Go module: `github.com/glincker/theauth-go/v2`.
- License: MIT. Self-hosted against your own database (SQLite, PostgreSQL, MySQL or Cloudflare D1). No hosted service is required.
- Runtimes: Node, Bun, Deno and Cloudflare Workers. Languages: TypeScript, Go, Python (beta), Terraform provider (source build).
- Scope: agent identity (scoped permissions, delegation chains, audit), MCP OAuth 2.1 authorization server, passkeys and 14 human sign-in methods, SAML and OIDC SSO, SCIM.
- Canonical site: https://theauth.dev. Documentation: https://docs.theauth.dev. Source: https://github.com/glincker/theauth.

## Start here

- [theAuth homepage](https://theauth.dev/): what theAuth is, the code, the standards it implements and a FAQ.
- [Quickstart](https://docs.theauth.dev/quickstart): install and create your first agent identity.
- [Documentation](https://docs.theauth.dev/): concepts, guides and API reference.
- [Agent identity docs](https://docs.theauth.dev/agents): agent tokens, delegation chains, policies.
- [MCP OAuth 2.1 docs](https://docs.theauth.dev/mcp): authorization server for the Model Context Protocol.
- [Permissions](https://docs.theauth.dev/permissions): wildcard permission matching and policy checks.
- [API reference](https://docs.theauth.dev/api): endpoints and types.
- [Go documentation](https://docs.theauth.dev/go): concepts, guides and reference for the Go SDK.
- [theAuth CLI](https://github.com/glincker/theauth/tree/main/packages/cli): `@glinr/theauth-cli`, run with `npx theauth`. Scaffold and manage a theAuth project from the terminal.
- [Gateway](https://docs.theauth.dev/gateway): `@glinr/theauth-gateway`, an auth proxy that enforces theAuth policies in front of any HTTP service.
- MCP server: `@glinr/theauth-mcp`, an MCP server for inspecting agent identity, permissions and audit. It is not published to npm yet, so there is no link.
- [Docs index for LLMs](https://docs.theauth.dev/llms.txt): the documentation site's own llms.txt, and [all docs as one file](https://docs.theauth.dev/llms-full.txt).

## Get started and guides

- [Get started with theAuth: human and agent auth](https://theauth.dev/get-started/): Install theAuth for TypeScript or Go. Two tracks: human sign-in with sessions, and AI agent auth with scoped tokens and an MCP OAuth 2.1 server.
- [theauth-go: Go auth library with MCP authorization](https://theauth.dev/go/): theauth-go is an MIT Go library for human sign-in, OAuth 2.1 and MCP authorization with DPoP, CIBA, PAR and JAR. Install with go get.
- [theAuth changelog: TypeScript and Go release notes](https://theauth.dev/changelog/): Recent theAuth releases for TypeScript and theauth-go in one place, summarized from each changelog, with links to the full release notes on GitHub.

- [theAuth guides: MCP, Hono and Go tutorials](https://theauth.dev/guides/): theAuth tutorials that run end to end: secure an MCP server in TypeScript, add human and agent auth to Hono, and build an MCP authorization server in Go.
- [Secure an MCP server with theAuth in 10 minutes](https://theauth.dev/guides/mcp-server-typescript/): Put OAuth 2.1 in front of a TypeScript MCP server: dynamic client registration, PKCE S256, scoped tokens and a protected route. Every command was run.
- [Add human login plus agent auth to a Hono app](https://theauth.dev/guides/hono-human-and-agent-auth/): Add magic-link login for people and scoped tokens for AI agents to one Hono app. A signed-in user mints an agent that calls its own routes. Tested.
- [Build an MCP authorization server in Go](https://theauth.dev/guides/mcp-authorization-server-go/): Run an OAuth 2.1 authorization server and a protected MCP route in one Go program with theauth-go: discovery, registration, PKCE and token checks.

## Product

- [Identity for AI agents: scoped tokens and audit](https://theauth.dev/agent-identity/): Give each AI agent its own kv_ token, wildcard permissions, depth-limited delegation, budget policies, approval gates and a per-action audit trail. MIT.
- [Human auth: 14 methods, 17 OAuth providers](https://theauth.dev/human-auth/): Passkeys, TOTP, magic link, SSO and 14 sign-in methods with 17 OAuth providers for the humans behind agents, plus 11 framework adapters.
- [MCP OAuth 2.1 authorization server](https://theauth.dev/mcp-oauth/): Run theAuth as your MCP OAuth 2.1 authorization server: PKCE S256, RFC 9728, 8707, 8414 and 7591, refresh rotation and a zero-dependency resource module.
- [Enterprise auth: SSO, SCIM, RBAC, audit export](https://theauth.dev/enterprise/): Organizations with RBAC, SAML and OIDC SSO, SCIM 2.0, API keys, tenant tagging, audit export to webhook or Splunk, GDPR tools and compliance mapping.
- [theAuth pricing: free to self-host, Cloud early access](https://theauth.dev/pricing/): theAuth is MIT licensed and free to self-host. Cloud is in early access with no published prices. Compare total cost against per-MAU pricing.
- [DPoP, device flow and passkeys for agents](https://theauth.dev/agent-oauth/): How theAuth handles DPoP tokens, device flow, CIBA approval and passkeys for AI agents and the humans behind them, with status for Go and TypeScript.
- [theAuth features: TypeScript and Go compared](https://theauth.dev/features/): Every capability of the theAuth TypeScript and Go libraries side by side, with stable, beta, planned or unverified status and source links.
- [Migrate from Auth0, Keycloak or Clerk](https://theauth.dev/migrate/): Move users and passwords to theAuth one login at a time. Import from Auth0, Keycloak, Clerk or Better Auth, run both systems, roll back with one number.

## Compare

- [Auth0, Clerk and Better Auth Alternatives](https://theauth.dev/compare/): Compare theAuth with Auth0, Clerk, Better Auth, Supabase, Firebase and Keycloak. Sourced alternatives for AI agents, and where each one wins.
- [Auth0 vs theAuth: Auth0 Alternative for AI Agents](https://theauth.dev/compare/auth0/): Compare theAuth and Auth0: an open source, self-hosted Auth0 alternative for AI agents with MCP OAuth 2.1, delegation and audit. Where Auth0 wins.
- [Auth0 Auth for MCP vs theAuth: MCP Authorization](https://theauth.dev/compare/auth0-for-mcp/): Compare Auth0 Auth for MCP and Token Vault with theAuth's MCP authorization server and agent identity: hosted or self-hosted, and where Auth0 is better.
- [Stytch vs theAuth: Stytch Alternative for AI Agents](https://theauth.dev/compare/stytch/): Compare Stytch and theAuth: Stytch Connected Apps is a hosted OAuth server for MCP, theAuth an MIT library you self-host with agent identity.
- [WorkOS vs theAuth: WorkOS Alternative for MCP Auth](https://theauth.dev/compare/workos/): Compare WorkOS AuthKit and theAuth for MCP authorization: WorkOS hosts the OAuth server, theAuth is an MIT library you self-host. Where WorkOS wins.
- [Descope vs theAuth: Descope Alternative for AI Agents](https://theauth.dev/compare/descope/): Compare Descope Agentic Identity Hub and theAuth: both give AI agents identities and MCP OAuth 2.1, hosted or as an MIT library. Where Descope wins.
- [Clerk Alternative for AI Agents | theAuth vs Clerk](https://theauth.dev/compare/clerk/): theAuth vs Clerk: an open source, self-hosted Clerk alternative for AI agents with MCP OAuth 2.1, delegation and audit. Where Clerk is the better pick.
- [Better Auth vs theAuth: Alternative for AI Agents](https://theauth.dev/compare/better-auth/): Better Auth vs theAuth: two MIT TypeScript auth libraries. See how agent identity, MCP OAuth 2.1 and Go and Python SDKs differ, and where it wins.
- [Supabase Auth Alternative for AI Agents](https://theauth.dev/compare/supabase-auth/): theAuth vs Supabase Auth: an open source Supabase Auth alternative for AI agents, with MCP OAuth 2.1 and delegation. See when Supabase and RLS win.
- [Firebase Auth Alternative for AI Agents](https://theauth.dev/compare/firebase-auth/): theAuth vs Firebase Authentication: a self-hosted, open source Firebase Auth alternative for AI agents with MCP OAuth 2.1. Where Firebase fits better.
- [Keycloak Alternative for AI Agents | theAuth vs Keycloak](https://theauth.dev/compare/keycloak/): theAuth vs Keycloak: a lighter open source Keycloak alternative for AI agents, embedded in your app with MCP OAuth 2.1. When Keycloak is the better call.

## Use cases

- [theAuth use cases: MCP servers, agents, SaaS](https://theauth.dev/use-cases/): Four problems and the code path for each: OAuth 2.1 for an MCP server, identity for AI agents, B2B SaaS with SSO, and auth for AI startups.
- [Identity and permissions for AI agents](https://theauth.dev/use-cases/ai-agents/): Give every AI agent its own identity: scoped permissions, delegation with depth limits, a human owner, approval flows, budgets and an audit trail.
- [Multi-agent auth: delegation chains and revocation](https://theauth.dev/use-cases/multi-agent/): Give each sub-agent its own identity, a narrower slice of its parent's permissions, a depth cap and cascading revocation. Tested TypeScript example.
- [Add auth to an MCP server with OAuth 2.1](https://theauth.dev/use-cases/mcp-servers/): Add OAuth 2.1 to an MCP server: PKCE S256, RFC 9728 resource metadata, client registration and scoped tokens per tool, with a TypeScript setup on Hono.
- [Auth for B2B SaaS with organizations and SSO](https://theauth.dev/use-cases/saas/): B2B SaaS auth with organizations and RBAC, SAML and OIDC SSO, SCIM provisioning and tenant tagging, in a library you can run in your own infrastructure.
- [Enterprise auth: SSO, SCIM and audit, self-hosted](https://theauth.dev/use-cases/enterprise/): How theAuth answers an enterprise security review: self-hosted data, SSO, SCIM, agent audit and SIEM sinks, with honest limits and no certifications.
- [Auth for AI startups: ship fast, grow later](https://theauth.dev/use-cases/ai-startups/): Open source auth for TypeScript AI startups: scaffold with create-theauth-app, use Next.js or Hono on edge runtimes, then add SSO and SCIM later.

## SDKs and code

- [theAuth (TypeScript)](https://github.com/glincker/theauth): `npm install @glinr/theauth`. Runs on Node, Bun, Deno and Cloudflare Workers.
- [theauth-go](https://github.com/glincker/theauth-go): `go get github.com/glincker/theauth-go/v2`. OAuth 2.1 and MCP authorization server for Go 1.25+.
- [Go reference](https://pkg.go.dev/github.com/glincker/theauth-go/v2): package documentation on pkg.go.dev.
- [npm package](https://www.npmjs.com/package/@glinr/theauth): `@glinr/theauth` core and framework adapters.
- [Python SDK](https://github.com/glincker/theauth/tree/main/sdks/python): beta, install from the repository.
- [Adapters](https://docs.theauth.dev/adapters): Next.js, SvelteKit, Nuxt, Hono, Express, Fastify, Astro, NestJS and more.

## Legal and trust

- [theAuth security: practices, disclosure, supply chain](https://theauth.dev/security/): How theAuth handles hashing, breach checks, rate limiting, signed Go releases and vulnerability disclosure, plus an honest list of what we do not claim.
- [Privacy policy: analytics only if you opt in](https://theauth.dev/privacy/): The theauth.dev site uses Google Analytics and PostHog only if you accept. This policy lists cookies, storage keys, third-party requests and contact.
- [Website terms of use and MIT licensing](https://theauth.dev/terms/): Terms for using the theauth.dev website. The theAuth library is licensed separately under the MIT license in each repository. Plain language.
- [Contact theAuth: support, security reports and community](https://theauth.dev/contact/): How to reach the theAuth team: GitHub Discussions for questions, Issues for bugs, a private form for vulnerabilities and email for everything else.
- [Security policy](https://github.com/glincker/theauth/blob/main/SECURITY.md): how to report a vulnerability privately.
- [License](https://github.com/glincker/theauth/blob/main/LICENSE): MIT.

## Open and measured

- [theAuth benchmarks: policy engine and Go hot paths](https://theauth.dev/benchmarks/): Measured throughput and latency for the theAuth policy engine and twelve Go hot paths, with hardware, versions, commit and the command to reproduce.
- [Open source and transparency](https://theauth.dev/open/): Where theAuth publishes its roadmap, API stability rules, threat model, governance, release process and compliance mapping, linked to source.
- [theAuth compliance: SOC 2 mapping and GDPR reference](https://theauth.dev/open/compliance/): Reports, not certifications: a SOC 2 criteria mapping and a GDPR data handling reference for theauth-go. No audit or certificate is claimed or published.
- [theAuth governance: who maintains it, how it decides](https://theauth.dev/open/governance/): How GLINCKER, the open-source division of GLINR STUDIOS, maintains theAuth: roles, decisions, releases and how to contact the team.
- [theAuth releases: how Go and TypeScript ship](https://theauth.dev/open/releases/): How theauth-go releases are cut, signed and verified, how TypeScript packages are versioned, and the latest versions. No release schedule is promised.
- [theAuth roadmap: what is shipped and in flight](https://theauth.dev/open/roadmap/): What the theauth-go ROADMAP.md lists as shipped, in flight and under consideration, with the changelog as the record, and what the TypeScript side has.
- [theAuth API stability: SemVer rules for Go and TS](https://theauth.dev/open/stability/): How theauth-go applies strict Semantic Versioning, which packages are stable or experimental, and why the TypeScript core is pre-1.0.
- [theAuth threat model: boundaries, scope, catalog](https://theauth.dev/open/threat-model/): A summary of the theauth-go threat model: STRIDE method, trust boundaries, what is in scope, what operators own, and how the threat catalog is organized.

## Optional

- [Full site as Markdown](https://theauth.dev/llms-full.txt): every page above rendered to plain Markdown in one file.
- [Ask endpoint](https://theauth.dev/ask?query=how+do+agent+delegation+chains+work): NLWeb-style search over this site, JSON or streaming (`streaming=true`).
- [Sitemap](https://theauth.dev/sitemap.xml): all indexable pages with last modified dates and images.
- [Security contact](https://theauth.dev/.well-known/security.txt): how to report a vulnerability.
- [humans.txt](https://theauth.dev/humans.txt): who makes the site.
- [Changelog](https://github.com/glincker/theauth/blob/main/CHANGELOG.md): release notes.
- [Releases](https://github.com/glincker/theauth/releases): tagged versions.
- [Discussions](https://github.com/glincker/theauth/discussions): questions, ideas and Cloud early access.
- [Terraform provider](https://github.com/glincker/theauth/tree/main/sdks/terraform): source build, not yet in a registry.
- [Examples](https://github.com/glincker/theauth/tree/main/examples): runnable example apps.
- [GLINR STUDIOS](https://glinr.com): the parent studio. [GLINCKER](https://glincker.com) is its open-source division and owns the GitHub org. Founder: [thegdsks.com](https://thegdsks.com).
- Partner open-source projects: [LevelRail](https://levelrail.com), [theSVG](https://thesvg.org) (brand icons) and [GLINUI](https://glinui.com) (UI components, the design basis of this site).

Facts: MIT licensed and self-hostable. Hosted theAuth Cloud is in early access with no published prices. Compliance reports map to the EU AI Act, NIST, SOC 2 and ISO 42001. They are reports, not certifications.