teamhanko/hanko

Features

• Identity and Access Management - Implements a comprehensive system for verifying user identities, managing credentials, and enforcing authorization policies for customers.
• Passwordless Authentication - Implements a complete passwordless identity system utilizing both device-resident passkeys and email-based passcodes.
• Passkey Authentication - Implements FIDO2 and WebAuthn standards to provide passwordless authentication via device-resident passkeys.
• Registration Flows - Implements a multi-step, state-driven process for creating new user accounts via various authentication methods.
• Authentication Login Handlers - Provides services for processing user credentials through multi-step sequences and establishing secure sessions.
• Email Authentication Strategies - Provides passwordless authentication using email-based verification codes in place of traditional passwords.
• Email Verification Flows - Initiates passwordless login by sending a temporary verification code to the user's email.
• External Identity Provider Integration - Processes requests and tokens from third-party identity providers after successful authentication.
• Session and Credential Management - Manages user session lifecycles, token validation, and the protection of application routes.
• Pre-built Authentication Components - Provides pre-built login components that manage sign-in and sign-up flows.
• OAuth and Identity Providers - Acts as a gateway connecting applications to external identity providers via OAuth and SAML for single sign-on.
• Apple Authentication Providers - Enables user identity verification through existing Apple accounts via OAuth 2.0 and OpenID Connect.
• WebAuthn Registrations - Retrieves a list of all WebAuthn credentials associated with the currently authenticated user.
• OAuth Provider Integrations - Provides standardized interfaces for connecting to external OAuth and SAML identity providers.
• User Profile Management - Provides detailed retrieval of user identity, including associated emails and registered passkeys.
• Identity Federation Providers - Integrates external identity providers via OAuth and SAML protocols to enable single sign-on.
• SSO Integrations - Provides integrations with external single sign-on services for centralized identity and access management.
• Identity Providers - Operates as a centralized identity provider issuing tokens using standard OAuth, OIDC, and SAML protocols.
• Identity API Endpoints - Offers specialized API endpoints for managing user registration, authentication, and identity records.
• Identity Token Services - Validates identity tokens using a public key set to ensure they were issued by a trusted provider.
• Authentication Flow Orchestration - Orchestrates multi-step authentication and registration by shifting UI state logic to the backend API.
• JWT Claim Validation - Verifies identity claims within session tokens to confirm user status and permissions.
• Multi-Factor Authentication - Implements secondary authentication methods including TOTP, security keys, and passkeys.
• GitHub OAuth Providers - Integrates GitHub as an identity provider for secure user authentication via OAuth 2.0.
• Google OAuth Providers - Provides identity verification using Google OAuth 2.0 and OpenID Connect protocols.
• Credential Listing - Provides functionality to retrieve all registered passkey credentials associated with a user account.
• Credential Management - Provides a comprehensive API to manage, retrieve, and revoke passkey credentials linked to user identities.
• Credential Retrieval - Fetches specific passkey credential details using unique identifiers and credential IDs.
• Registration Finalization - Validates authenticator attestation responses to complete the registration of a new passkey.
• Registration Initialization - Initiates passkey registration by generating the necessary challenges and configuration for the browser API.
• Registration Options Generation - Generates the configuration object required by the browser to register a new passkey.
• Enrollment Completion - Verifies WebAuthn API responses to finalize the enrollment of a new passkey credential.
• Login Options Generation - Generates credential request options for the browser API to facilitate passwordless login.
• JWKS Distribution - Provides a JWKS endpoint for public verification of signed identity tokens without shared secrets.
• SAML Authentication - Processes SAML responses from external identity providers to complete the single sign-on process.
• SAML SSO Integrations - Connects to SAML 2.0 compatible identity providers using metadata URLs for enterprise single sign-on.
• Session Token Validation - Verifies session tokens against an API to ensure the user remains authenticated.
• Session & Cookie Handlers - Manages user authentication state using signed session tokens delivered via secure cookies.
• Session Lifecycle Management - Manages the complete session lifecycle, including creation events and login redirects.
• Session Generation - Generates session tokens for specific users to grant authenticated application access.
• User Session Termination - Terminates active user sessions with optional redirection to a designated page.
• Token Invalidation - Terminates active sessions by clearing cookies and invalidating associated tokens.
• Social Login Providers - Redirects users to external OAuth providers to initialize social login and obtain authorization codes.
• Third-Party Authentication Providers - Provides authentication via external identity providers using generic OAuth and SAML protocols.
• Two-Factor Authentication - Enforces multi-factor authentication and single sign-on requirements to ensure secure identity verification.
• Identity Verification - Validates one-time codes sent via email to confirm the identity of the user.
• User Account Management - Provides a user-facing interface for managing emails, passwords, and security settings.
• Discord Identity Providers - Integrates Discord as an identity provider to allow users to sign in with social accounts.
• User Identity Management - Implements a comprehensive system for managing user profiles, authentication methods, and identity-related data lifecycles.
• Identity Provisioning - Implements registration of new user identities with unique identifiers and associated profile data.
• User Profile Retrieval - Allows the application to retrieve the current authenticated user's profile via session tokens.
• Session State Validation - Verifies user sessions via cookies or headers without modifying activity timestamps.
• User Administration - Provides a protected administrative API to perform full CRUD operations on user records.
• Authentication UI Components - Ships a set of customizable web components for embedding authentication and profile management interfaces into any web application.
• Component Embedding - Ships framework-agnostic web components for handling login and registration directly within web pages.
• Unified Auth Interfaces - Provides a single web component that manages both user login and registration flows.
• Authentication SDK Bridges - Provides a client-side SDK that abstracts complex passkey and authentication flows for frontend applications.
• UI Component Embedding - Provides framework-agnostic authentication interfaces as customizable web components for easy embedding.
• Registration Interfaces - Ships a pre-built web component for account creation via passkeys, OAuth, SAML, or passwords.
• Session Revocations - Provides a profile interface for users to view and revoke other active sessions.
• Account Deletion - Provides functionality to permanently remove user accounts and all associated identity data.
• Identity Email Associations - Allows associating new email addresses with a user identity for account communication and recovery.
• External System Synchronization - Synchronizes user identity information with external databases during sign-up or session creation.
• Input Validation - Implements server-side validation of identity data with detailed error metadata for user corrections.
• Event Webhooks - Triggers external HTTP POST notifications to synchronize identity changes with third-party services.
• Custom Domains - Enables mapping of authentication services to branded custom domains using DNS and SSL.
• Attribute-Based Access Control - Enforces request permissions by evaluating user attributes, roles, and relationships via a centralized policy engine.
• Password Authentication Configurations - Implements password-based login flows as a fallback or alternative to passkey authentication.
• Profile Management Flows - Provides specialized sequences for email verification, password updates, and security key management.
• Authentication Workflows - Provides configurable built-in workflows for managing the lifecycle of login, registration, and recovery processes.
• Email Verification Services - Provides retrieval of the verification status for specific user email addresses.
• Relationship-Based Access Controls - Implements access control based on the relationships between users and objects, such as organization membership.
• Identity Synchronization - Pushes user profile data and default roles to external policy engines automatically upon user registration.
• Authorization Services - Connects authenticated identities to external authorization services for permission evaluation via HTTP or gRPC.
• API Request Authentication - Validates requests to protected endpoints using tokens and JWK sets to ensure authenticity.
• Bulk User Imports - Enables the migration of existing accounts from other providers via JSON array uploads.
• Email Address Management - Passkey capability to designate a specific email address as the main identifier for account communications.
• Session Claims - Supports template syntax for adding static or dynamic custom claims to session tokens.
• Session Data Injection - Injects user profile data into tokens to make attributes available without extra API calls.
• Session Lists - Provides an interface to list all current active sessions for a specific user.
• Session-Based Access Controls - Protects application routes by verifying the authenticity of server-side session tokens.
• State-Driven Flow Control - Uses backend logic to determine the required UI states and transitions for the authentication sequence.
• User Directory Listing - Provides paginated retrieval and filtering of registered users for directory management.
• Multi-Tenant Authentication Services - Ensures passkey credentials are isolated within specific tenants to prevent cross-organization authentication.
• Configuration Retrieval - Provides mechanisms to fetch active authentication settings to determine which login methods to render in the UI.
• Authentication Transaction Management - Creates unique transactions to track the state of individual passkey login or registration attempts.
• Credential Registrations - Provides the process for initializing and storing passkeys as second-factor authentication credentials.
• Legacy Integration - Enables the addition of passkey support to existing authentication systems by linking credentials to established accounts.
• Password Authentication - Provides traditional identity verification by matching provided passwords against stored identifiers.
• Public Key Retrieval - Provides a JWKS mechanism to retrieve public keys for validating signed identity tokens.
• Role-Based Access Control - Restricts application actions based on assigned user roles verified through a centralized policy check.
• Route Protection - Restricts access to specific application pages by validating session tokens on the backend.
• Configuration Retrieval - Retrieves the service provider configuration for a specific domain to enable SAML single sign-on.
• Metadata Provisioning - Provides service provider metadata and certificates required to establish trust with SAML identity providers.
• Secure Token Exchange - Implements the token exchange flow required to authenticate users when SAML is enabled.
• Token-to-Session Conversion - Converts one-time tokens into session tokens delivered via cookies or response headers.
• Token Signature Verification - Publishes public keys via a standard endpoint for clients to validate identity token authenticity.
• Transaction Authorization - Requires users to authenticate with a passkey to authorize specific sensitive transactions.
• Password Assignment - Allows setting a password for a specific user account to enable traditional credential-based access.
• Password Resets - Allows administrators to override and update user passwords via a protected interface.
• Password Revocation - Provides the ability to delete a user password to transition an account to passwordless authentication.
• Event-Driven Callbacks - Provides custom callback triggers during login or logout to handle redirects and state updates.
• Webhook Event Notifications - Sends real-time HTTP POST notifications to callback URLs when identity events occur.
• Event Webhook Management - Provides webhook management for synchronizing identity data via triggers tied to database events.
• Account Provisioning - Automatically creates or links local user accounts to external identity provider profiles based on email matching.
• User Session Monitors - Tracks authentication state and provides methods to fetch profile details and validate sessions.
• Administrative Session Control - Provides an administrative interface to create, list, and delete active sessions for specific users.
• Audit Logs - Includes an inspection interface for reviewing paginated system activity logs filtered by user and event.
• Identity Data Exports - Provides an administrative API for retrieving user information and identity records for backup or migration.
• User Metadata Inspection - Offers an administrative interface to inspect custom attributes and profile information for users.
• Custom Authentication Interfaces - Provides a flow-based API to implement custom frontend interfaces for authentication verification.
• Profile Management Interfaces - Provides a pre-built interface for users to manage email addresses and authentication credentials.
• Event Listeners - Implements event handlers that trigger custom logic when identity states change.
• Type-Safe API Clients - Ships a type-safe client for interacting with identity and authentication endpoints across browser and server environments.
• Custom Metadata Storage - Supports storage of arbitrary JSON metadata within user profiles with configurable visibility.
• Authentication and Authorization - Integrates open-source authentication and user management.
• Authentication and Identity - Passwordless authentication using WebAuthn APIs.

Star history