The monorepo behind SourceOrigin and Origin Auth: one account, an Origin Account secured by passkeys, for SourceOrigin's services and any app built on them.
- Origin Auth, at auth.sourceorigin.dev, is a passkey-first OpenID Connect provider. It serves sign-in, the account settings and the developer console, where anyone can register an app. It is one Rust executable, with PostgreSQL as its only data service. GitHub and Google are optional ways to sign in.
- admin.sourceorigin.dev is the admin dashboard, served by the same executable on a private listener. Administrators manage accounts there, and invite people by email or with a link to pass on.
- sourceorigin.dev is the homepage and policies.
- The SDKs,
sourceorigin-authfor Rust and@sourceorigin/authfor TypeScript, sign users in and validate auth's tokens. They are published to crates.io and npm, withsourceorigin-commonandsourceorigin-crypto, which the Rust SDK depends on. Nothing else is published; see releasing.
The documentation has a user guide, for account holders and app developers, and a contributor guide, for people who change SourceOrigin.
just install-tools # once
just build
just preview # deploy this checkout to a private previewSee getting started for the tools these need.
| Path | What it is |
|---|---|
apps/auth-service |
auth.sourceorigin.dev, the admin dashboard and the operator CLI |
apps/web |
sourceorigin.dev's own site |
crates/ |
auth-sdk (the Rust SDK), common, crypto, database, telemetry and ui |
packages/auth |
the TypeScript SDK |
infra/ |
Dockerfiles and piqueld deployments |
tests/ |
the browser tests and the cases every SDK passes |
tools/xtask |
cargo xtask, which publishes the SDKs and releases a version |
docs/ |
the documentation book |
- Questions and feedback: contact@sourceorigin.dev
- Security vulnerabilities: security@sourceorigin.dev, privately; see SECURITY.md.
SourceOrigin is free to use, change and share for any purpose except a commercial one,
under the PolyForm Noncommercial License 1.0.0. The SDKs, and the
crates they depend on, are under the Apache License 2.0 instead,
so any application, commercial or not, can sign its users in with Origin Auth:
crates/auth-sdk, crates/common, crates/crypto and packages/auth.