Identity that fits your stack.
INITE is an OAuth 2.0 / OIDC provider with passkeys, magic links, password fallback, Web3 wallet linking, and a service-token surface for backend-to-backend auth. Drop the SDK into your app, embed the iframe, or wire AI assistants in via MCP — no redirects required.
Passkeys
Phishing-resistant sign-in with Touch ID, Face ID, Windows Hello, or a hardware key.
OAuth 2.0 / OIDC
Standards-compliant authorization code + PKCE, refresh rotation, PAR, DPoP, back-channel logout.
Service tokens
client_credentials grant with audience binding and scoped JWTs — fleet-safe M2M auth.
Magic links
Passwordless email sign-in with rate limiting, replay protection, and HIBP-checked fallbacks.
Web3 wallets
Ethereum, Polygon, and TON linked via signed challenges — keep your crypto identity portable.
DID identity
Every user gets a did:key — portable across the INITE ecosystem and out of it.
AI-ready (MCP)
Six auth-admin tools and three skills shipped via @inite/auth-admin — Claude Desktop, Cursor, Goose, n8n provision clients and respond to incidents through MCP.
Security defaults that don't need a security team.
Every primitive is on by default — you opt out of hardening, not into it. Audit log is queryable by both end users and operators.
- Account lockout with exponential backoff
- HIBP breached-password rejection
- Per-IP credential-stuffing defence
- Audit log surfaced to users and admins
- Embed-ready: CORS + CSP per partner
- Self-hostable, OSS license
Embed in five lines.
Headless SDK + drop-in iframe widget. CORS and CSP auto-allow registered partner origins.
import { IniteAuth } from '@inite/auth-sdk'
const auth = new IniteAuth({ clientId: 'your-app-id' })
const { user, accessToken } = await auth.loginWithPassword({
email, password,
})AI assistants ship as a peer dependency.
Two lines in your vertical's bootstrap exposes provisioning, rotation, audit and revoke through every MCP client. Per-tenant role gates layer on top of OAuth scope.
import { registerAuthAdminTool, authAdminSkills } from '@inite/auth-admin'
import { registerSkill } from '@inite/skills'
registerAuthAdminTool()
for (const s of authAdminSkills) registerSkill(s)Questions people ask before adopting.
- What is INITE Identity?
- INITE Identity is a self-hostable OAuth 2.0 and OpenID Connect provider. It covers passkeys, magic links, password fallback, one-time codes, social sign-in and Web3 wallet linking, plus service tokens for backend-to-backend authentication, behind one SDK, an embeddable iframe, or an MCP surface for AI assistants.
- Which sign-in methods does INITE Identity support?
- Six: passkeys (WebAuthn via Touch ID, Face ID, Windows Hello or a hardware key), passwordless magic links by email, password with HIBP breached-credential rejection, one-time codes, social providers, and Web3 wallets on Ethereum, Polygon and TON linked through signed challenges. Every user also receives a portable did:key identifier.
- Can I self-host INITE Identity?
- Yes. The service is open core, licensed under AGPL-3.0-or-later, and ships with Docker Compose, Prisma migrations, metrics and backup guidance. A commercial license is available for proprietary distribution or hosted offerings that cannot meet the AGPL network-source obligation.
- Which OAuth 2.0 and OIDC features are implemented?
- Authorization code with PKCE, refresh-token rotation, the client_credentials grant with audience binding, the device grant, Pushed Authorization Requests (PAR), DPoP sender-constrained tokens, and back-channel logout. Discovery is served at /.well-known/openid-configuration with keys at /.well-known/jwks.json.
- How do AI assistants integrate with INITE Identity?
- Through the Model Context Protocol. The @inite/auth-admin package exposes six auth-administration tools and three guided skills that any MCP client — Claude Desktop, Cursor, Goose, n8n — can call to register and rotate OAuth clients, inspect audit trails and revoke sessions, acting as the signed-in administrator rather than a separate service identity.
- How is INITE Identity secured by default?
- Hardening is opt-out, not opt-in: account lockout with exponential backoff, rejection of passwords found in known breaches, per-IP credential-stuffing defence, and an audit log queryable by both end users and operators. CORS and CSP auto-allow only registered partner origins.