ezAuth Documentation

A multi-tenant authentication platform with email/password, magic links, OAuth, bot auth, custom data tables, and S3 object storage.

What is ezAuth?

ezAuth is a self-hosted authentication and user management service built with FastAPI and PostgreSQL. It provides everything you need to add auth to your applications:

• Multiple auth methods — email/password, magic links, 6-digit codes, Google & Apple OAuth, bot authentication (Ed25519)
• Multi-tenant — one instance serves many applications, each with their own users, keys, and config
• RS256 JWTs — per-app RSA key pairs with a public JWKS endpoint for offline verification
• Session management — short-lived access tokens (15 min) + long-lived refresh tokens (30 days) with rotation
• Cross-domain SSO — share sessions across apps in the same tenant via secure token exchange
• Custom data tables — create typed, user-scoped database tables via the API
• Object storage — user-scoped file uploads via S3-compatible backends
• Anti-abuse — hashcash proof-of-work, rate limiting per IP and email
• Admin dashboard — manage tenants, apps, users, domains, and OAuth providers

Architecture

ezAuth follows a multi-tenant architecture with two levels of hierarchy:

• Tenant — a top-level organization
• Application — belongs to a tenant. Each app has its own users, sessions, keys, and configuration. Use separate apps for dev/staging/production environments.

Each application gets two API keys:

• Publishable key (pk_...) — safe to embed in frontend code. Used for sign up, sign in, and user-facing operations.
• Secret key (sk_...) — used server-side for admin operations like creating users, revoking sessions, and managing tables.

SDK Libraries

Security Features