AuthKit is an authorization server that works alongside Keycloak to provide long-lived access tokens for REST and gRPC applications and services.

Separation of concerns:

• Keycloak → User authentication (login, sessions, SSO)
• AuthKit → API authorization (tokens, scopes, access control)

⚠️ AuthKit does NOT handle user authentication.
Users must authenticate via Keycloak (or OAuth2/OIDC) before generating API tokens.

sequenceDiagram
    participant User
    participant Dashboard
    participant AuthKit
    participant YourAPI

    Note over User,Dashboard: One-time: Generate Access Token
    User->>Dashboard: 1. Login (via Keycloak)
    User->>Dashboard: 2. "Generate New Token"
    Dashboard->>AuthKit: 3. Create token (user_id, scopes)
    AuthKit->>Dashboard: 4. authkit_abc123...
    Dashboard->>User: 5. Display token to copy

    Note over User,YourAPI: Ongoing: Use Token in API Calls
    User->>YourAPI: 6. API Request (Bearer authkit_abc123...)
    YourAPI->>AuthKit: 7. Validate token
    AuthKit->>YourAPI: 8. ✅ Valid + user_id + scopes
    YourAPI->>User: 9. Response

Simple Flow:

1. Authenticate once - Login to dashboard via Keycloak
2. Generate tokens - Create tokens for different apps and environments
3. Use anywhere - Copy token and use in apps, scripts, or automation
4. Validate automatically - Your API validates tokens with AuthKit on each request

• 🔑 Multiple tokens per user - Separate keys for different apps/environments
• 🎯 Custom scopes - Fine-grained permissions per token
• ⏰ Flexible expiration - Set TTL or create permanent tokens
• 🔄 Instant revocation - Delete/regenerate from dashboard
• 📊 Usage tracking – See when each token was last used
• 🔒 Secure by default – Hashed tokens, encrypted storage
• ⚡ High performance - Sub-10ms validation, built for scale

Problem: Keycloak is excellent for user authentication, but it's not designed for API token management:

• ❌ Tokens tied to user sessions (expire when user logs out)
• ❌ No support for long-lived API keys
• ❌ Complex scope management for API endpoints
• ❌ Not optimized for service-to-service auth

Solution: AuthKit handles API authorization separately:

• ✅ Long-lived tokens independent of user sessions
• ✅ Multiple tokens per user (dev, staging, prod)
• ✅ Fine-grained API scopes
• ✅ Built for microservices and automation

Developer Workflows

• Separate tokens for local dev, staging, and production
• Personal access tokens for API testing

CI/CD & Automation

• GitHub Actions, GitLab CI, Jenkins authentication
• Scheduled jobs and cron tasks

Third-Party Integrations

• Partner API access with scoped permissions
• Webhook authentication and validation

Microservices

• Service-to-service authentication
• gRPC authorization

• Separation of concerns – Authentication (Keycloak) vs Authorization (AuthKit)
• Security first – Hashed tokens, audit logs, zero-trust validation
• Stateless validation – No sessions, no shared state
• Hybrid API design – RESTful HTTP and gRPC endpoints, OpenAPI specification
• Self-hostable - Run on your infrastructure or use our cloud

We welcome contributions from the community!

💬 Join our Discord – Get help and discuss ideas
🐛 Report Issues – Founds a bug?
🤝 Contributing Guide – How to contribute