Your users connect anything.
You never touch a token.
A four-tier identity service plus an encrypted per-end-user credential broker: RS256 JWTs verified locally via JWKS on your side, OAuth flows to every external service handled entirely on ours.
Read the docsMulti-tenant identity and OAuth brokering are not a weekend project.
You need a login hierarchy that scopes by tier, JWTs a downstream service can verify without a network call, and a place to put every external OAuth token your users grant — encrypted, isolated per tenant, and refreshed without anyone noticing. Auth Manager owns all of it, so credential logic never lives in two places.
Four-tier identity
Administrator → Organization → Application → User. Each tier has its own ID format and login model, so permissions never escalate by accident.
RS256 JWTs, verified locally
Every downstream service checks signatures against the published JWKS endpoint — no network hop, no phoning home per request, with a 24-hour key-rotation overlap.
The credential broker
Per-end-user OAuth tokens for every connected external service, isolated per tenant, never exposed to your servers as anything but a scoped JWT.
PKCE-enforced OAuth
Every authorization-code flow is PKCE-protected end to end, closing the interception window that plain OAuth leaves open on public and mobile clients alike.
Envelope encryption at rest
External tokens are wrapped in AES-256-GCM envelope encryption before they ever touch disk — the broker holds the keys, your app never does.
Argon2id password hashing
Platform-tier and admin credentials hash with Argon2id, tuned for memory-hardness — not the fast, GPU-crackable hashes most homegrown auth still ships.
From "Connect" to a verified request, in one flow.
THE BROKERING LOOP
Initiate — your user clicks "Connect" inside your app; the request names the tier — which end user, which org — and the external service.
Redirect — Auth Manager builds a PKCE-protected authorization URL and redirects to the external service's own login and consent screen.
Authorize — the user grants access on the external service's own screen — Auth Manager, and your app, never see their password there.
Exchange — the returned code exchanges for tokens against a verified PKCE code_verifier; nothing touches your servers in transit.
Encrypt & store — access and refresh tokens are wrapped in AES-256-GCM envelope encryption and stored under that end user's isolated record.
Issue — your app receives a short-lived, 15-minute RS256 JWT scoped to that connection — verifiable locally via JWKS, no round trip required.
Refresh, transparently — as the JWT nears expiry or the upstream token needs refreshing, the broker rotates both without interrupting the calling app.
Login, identities, and tokens — one surface.
Built so a stolen request can't become a stolen identity.
Tokens never reach your servers — external OAuth tokens live only inside the broker's encrypted store; you see a scoped JWT, never the underlying credential.
Envelope-encrypted at rest — AES-256-GCM, key-per-tenant, rotated independently of the data it protects.
Argon2id password hashing — memory-hard hashing for every platform-tier credential, tuned against GPU cracking.
Short-lived, locally verified — 15-minute RS256 JWTs, checked against JWKS with no round trip — a leaked token is already stale.
PKCE-enforced flows — every authorization-code exchange requires a verifier; a stolen redirect can't complete a login on its own.
Tenant & credential isolation — four-tier scoping keeps one org's tokens from ever entering another's request path, audited at every issuance.
Identity problems that stop being your problem.
A user connects their calendar once; six months later every call still works — the broker has refreshed the token dozens of times without the app ever noticing.
An admin revokes one user's connection; that user's encrypted tokens are destroyed immediately, while every other tenant's connections keep running untouched.
Your API gateway checks a request's RS256 signature against cached JWKS keys in microseconds — no call back to Auth Manager on the hot path.
Auth Manager rotates its signing key; old and new public keys both stay valid in JWKS for 24 hours, so nothing already in flight breaks.
An admin, an org, an application, and an end user each authenticate through the same four-tier hierarchy — none can act outside its own scope, on paper or in practice.
Bring your identity model. We'll broker the rest.
From four-tier login to per-user OAuth credentials — Auth Manager owns the whole trust boundary, so tokens never sit on your servers.