FerrisKey — Open‑Source, High‑Performance Identity & Access Management
Cloud‑native • Extensible • Built in Rust

_Sponsors

FerrisKey is a modern Identity & Access Management (IAM) platform built with Rust and a hexagonal architecture. It aims to be a serious open‑source alternative to heavyweight IAMs fast, modular, and cloud‑native by design.

• 🦀 Performance-first — Rust, async I/O, low latency.
• 🧱 Hexagonal architecture — clean domain, clear ports/adapters.
• 🏢 Multi‑tenant realms — strong isolation of users/roles/clients.
• 🔐 Modern auth — OIDC/OAuth2, MFA (TOTP).
• 🧩 Extensibility — native modules for MFA, auditability, and webhooks.
• ☁️ Cloud‑native — official Helm chart; ready for Kubernetes.

• Features
• Quick Start
• Configuration
• Database Migrations
• Modules
• Architecture
• Observability
• Roadmap
• Adopters
• Contributing
• Code of Conduct
• Security
• License
• Links

License: Apache‑2.0. No paywalls. Community‑first.

For local development using the repo justfile, see DEVELOPMENT.md.

docker compose --profile registry up -d

Then visit http://localhost:5556 to access the console. The default credentials are admin and admin.

docker compose --profile build up -d

Important migration note (Postgres 18+ volume path): local compose mounts pgdata at /var/lib/postgresql (the Postgres 18+ recommended mount point). If you are migrating from an older local setup that used a different mount path, remove or migrate the old volume first. Quick reset (destructive): docker compose down -v.

Then visit http://localhost:5555 to access the console. The default credentials are admin and admin.

Requires a reachable Postgres (or include it via your platform’s recommended operator).

See chart documentation.

1. Clone the repo

git clone https://github.com/ferriskey/ferriskey

1. Launch the database and execute migrations with sourced env variables

cd api
cp env.example .env
# feel free to change the env variables in .env to your liking.
docker compose up -d
cd ../core
# to install sqlx you might need to run `cargo install sqlx-cli --no-default-features --features postgres`
DATABASE_URL=postgres://ferriskey:ferriskey@localhost:5432/ferriskey sqlx migrate run

1. Launch the API

# to upgrade rustc version to 1.89.0, you can run `rustup update`
cd ../api
cargo run

1. Launch the frontend (optional)

cd ../front
cp .env.example .env
pnpm install
pnpm run dev

Then visit http://localhost:5555 to access the console. The default credentials are admin and admin.

Common environment variables (example):

PORT=3333
ENV=development
LOG_LEVEL=info
DATABASE_URL=postgres://ferriskey:ferriskey@localhost:5432/ferriskey

ADMIN_PASSWORD=admin
ADMIN_USERNAME=admin
ADMIN_EMAIL=admin@ferriskey.rs

ALLOWED_ORIGINS=http://localhost:5555

ALLOWED_ORIGINS lists the origins accepted on every route. Beyond it, each client declares its own web origins at runtime, enforced per realm — see the web-origins endpoints under a client. Those per-client origins never replace ALLOWED_ORIGINS: /config, the health probes and the API docs carry no realm, so an admin console served from a different origin than the API must keep its origin in ALLOWED_ORIGINS.

By default, the API will listen on port 3333 and the frontend on port 5555.

FerrisKey uses SQLx for database migrations. To apply pending migrations:

cd core
DATABASE_URL=postgres://ferriskey:ferriskey@localhost:5432/ferriskey sqlx migrate run

To check migration status:

DATABASE_URL=postgres://ferriskey:ferriskey@localhost:5432/ferriskey sqlx migrate info

Note: If you have DATABASE_URL set in your environment or .env file, you can omit it from the command.

• Trident — MFA & security scopes TOTP, WebAuthn, Magic Link; flexible required actions.

• SeaWatch — Observability & audit logs Security event trails; queryable from the console; exportable.

• Webhooks — Event‑driven extensibility Subscribe to user/client/realm lifecycle events without forking core.

FerrisKey follows a Hexagonal Architecture (Ports & Adapters) to keep business logic pure and infrastructure replaceable.

• Metrics: /metrics (Prometheus format)
• Dashboards: Starter Grafana dashboards included in Helm values (optional)

The public roadmap is at https://ferriskey.rs/roadmap. ROADMAP.md lists the epics in progress and how the roadmap is maintained.

Organizations using FerrisKey are listed in ADOPTERS.md. If you run FerrisKey, add yourself with a pull request.

We welcome contributions of all kinds bugfixes, features, docs, testing.

1. Read CONTRIBUTING.md
2. Pick an issue (good first issues labelled)
3. Open a PR with tests and a concise description

Join discussions to help shape modules, APIs, and UX.

FerrisKey follows the CNCF Code of Conduct. See CODE_OF_CONDUCT.md for scope and how to report an incident.

Report vulnerabilities privately through the Security tab, never in a public issue. Supported versions, response targets and the disclosure process are in SECURITY.md.

Apache‑2.0 — free to use, modify, and distribute.

• 📂 Source: https://github.com/ferriskey/ferriskey
• 📦 Helm Chart (OCI): oci://ghcr.io/ferriskey/charts/ferriskey
• 📖 Documentation: https://docs.ferriskey.rs/en/discover/what-is-ferriskey
• 💬 Discussions: https://github.com/ferriskey/ferriskey/discussions
• 🏆 Sponsor: https://github.com/sponsors/ferriskey