OathMesh

🔐 Every machine call gets a short-lived, signed identity.

Stop leaking API keys. Replace static secrets with cryptographically verified tokens that expire in 5 minutes or less.

⚠️ Pre-production: OathMesh has not yet received an independent security audit, but it is currently structurally ready for Early Adopter/MVP deployments.

• 🔑 Zero API Keys — No more long-lived secrets in environment variables
• ⏱️ Short-Lived Tokens — Maximum 300 seconds TTL, auto-expiring credentials
• 🛡️ Zero-Trust Security — Every request must prove its identity
• 🔒 Ed25519 Signatures — Modern elliptic curve cryptography (KMS-backed via SignFunc abstraction)
• 📋 14-Step Verification — Func-slice pipeline with step-annotated errors for instant diagnosis
• 🌐 Polyglot SDKs — Go, Node.js (TypeScript), and Python supported
• 📊 Full Audit Trail — Every allow and deny logged via composable FanOutAuditSink
• 🔄 Policy-Driven — Apple Pkl-based rules, hot-reload, default deny
• 🌐 Gateway Integrations — Native Envoy ext_authz and Kong Go PDK plugins
• ⚡ Performance Proven — Sub-millisecond p99 latency overhead mathematically verified
• 🛠️ CLI Native — Terminal-driven management for robust GitOps integration
• 🛑 Stateful Revocation — Redis-backed O(1) revocation lists directly synced
• 🤖 CI Native Auto-Sign — Built-in OIDC exchange mappings for GitHub Actions and GitLab CI
• ⚡ Circuit-Breaker Replay Defense — Redis failover to in-process cache (never fails open)
• 🚀 JWKS Pre-Warming — Eliminate cold-start latency with JWKSCache.PreWarm(ctx)

Conformance note: Node.js and Python verifiers were tightened toward the canonical Go step semantics (for example: alg=none rejection, subject format validation, required request binding semantics, future-iat rejection, and fail-closed cache behaviors). This establishes exact behavioral parity.

Use this canonical developer entry flow:

1. Step 1 (commands): QUICKSTART.md
2. Step 2 (guided onboarding): docs/GETTING_STARTED.md
3. Step 3 (full docs index): docs/INDEX.md

Step 1 is the canonical runnable path for local verification (issuer http://localhost:4000, protected chi-api at http://localhost:8081).

Run the minimal local quality workflow:

make quality-local

If make is not available (for example on some Windows setups), run the same flow manually:

go test ./...
golangci-lint run ./...  # if installed
govulncheck ./...        # if installed

go install github.com/oathmesh/oathmesh/cmd/oathmesh@latest

npm install @oathmesh/sdk
# or
yarn add @oathmesh/sdk
# or
pnpm add @oathmesh/sdk

pip install oathmesh
# or
poetry add oathmesh

docker pull oathmesh/oathmesh:latest

r.Use(middleware.OathMeshMiddleware(cfg))
caller := middleware.CallerFrom(r.Context())
// caller.Principal.Subject, caller.Action, caller.TokenID

import { verifyToken } from '@oathmesh/sdk';

app.use(verifyToken({ audience, trustedIssuers }));
// req.oathmeshContext is fully typed

import { withOathMesh } from '@oathmesh/sdk/next';

const oathmesh = withOathMesh({ audience, trustedIssuers });

export async function GET(request: NextRequest) {
  const { caller, error } = await oathmesh(request);
  if (error) return error;
  return NextResponse.json({ subject: caller.principal.subject });
}

from oathmesh import verify_token, VerifierConfig

caller = verify_token(request.headers["authorization"], config)
# caller.principal.subject, caller.action, caller.token_id

┌──────────┐    ┌─────────┐    ┌─────────────────────┐
│ Caller   │───▶│ Issuer  │───▶│ Signs Oath Token    │
│ (bot, CI,│    │         │    │ (Ed25519, ≤300s TTL)│
│  service)│    └─────────┘    └─────────────────────┘
└──────────┘                         │
                     ┌────────────────┴────────────┐
                     ▼                             ▼
              ┌──────────────┐              ┌──────────────┐
              │   Receiver   │              │   Gateway    │
              │  (your API)  │              │ (proxy mode) │
              └──────────────┘              └──────────────┘
                     │                             │
              ┌──────┴──────┐               ┌───────┴───────┐
              │ 14-step     │               │ Injects       │
              │ verification│               │ X-OathMesh-*  │
              │ pipeline    │               │ headers       │
              └─────────────┘               └───────────────┘

Gateway Mode (oathmesh serve --gateway): A reverse proxy that verifies tokens and injects security context headers into your existing upstream services.

• 🔜 Rust SDK — Coming soon
• 🔜 Java SDK — Coming soon
• 🗓️ Policy UI — Visual policy editor
• 🗓️ Audit Dashboard — Web-based log viewer

Contributions are welcome! Here's how to get started:

1. Fork the repository
2. Clone your fork: git clone https://github.com/YOUR_USERNAME/oathmesh.git
3. Create a branch: git checkout -b feature/your-feature-name
4. Make your changes and add tests
5. Run tests: make test (Go) / npm test (Node) / pytest (Python)
6. Submit a PR — We'll review and merge!

See CONTRIBUTING.md for detailed guidelines.

If OathMesh helps you build safer systems, please:

• Star this repository ⭐
• Share it with your team
• Open an issue if you find a bug or have a feature request
• Contribute — We need SDKs for more languages!

• Protect a Go chi API
• Protect an Express API
• Protect a Next.js API
• Protect a FastAPI service
• GitHub Actions to internal API

• Getting started: issuer + receiver + verify
• gRPC integration
• GraphQL integration (Node + Python)
• CI/CD machine identity

• Linux VM Deployment (systemd)
• Docker Compose Deployment
• Kubernetes Deployment Guide
• TLS Configuration Guide

• Token Format · Claim Reference
• Verification Rules · Threat Model
• Replay Defense · Key Management
• SOC2 Compliance Matrix

• Policy Overview
• Policy Examples
• Policy Migration Guide

• Envoy ext_authz Integration
• Kong Go PDK Plugin

• Kubernetes Zero-Trust Benchmarks

• Full Documentation Index

For security vulnerabilities, please see SECURITY.md. Do NOT open a public issue for security vulnerabilities.

MIT

Built with ❤️ by the OathMesh team