# Authsome

> Documentation for Authsome, version 1.x.
> Every entry links to the page's markdown source.

Repository: https://github.com/xraph/authsome
Site: https://www.xraph.com/docs/authsome

## Pages

- [Go Packages](https://www.xraph.com/docs/authsome/api-reference/go-packages.md): Quick reference for all Authsome Go packages and their public APIs.
- [HTTP API Reference](https://www.xraph.com/docs/authsome/api-reference/http-api.md): Complete reference for all Authsome REST endpoints — authentication, users, sessions, MFA, devices, organizations, RBAC, webhooks, and OAuth2.
- [Architecture](https://www.xraph.com/docs/authsome/architecture.md): How Authsome packages fit together.
- [Magic Links](https://www.xraph.com/docs/authsome/authentication/magic-links.md): Passwordless email sign-in with time-limited magic link tokens.
- [Multi-Factor Authentication](https://www.xraph.com/docs/authsome/authentication/mfa.md): Add TOTP, SMS OTP, and recovery codes as a second authentication factor with the MFA plugin.
- [OAuth2 Provider](https://www.xraph.com/docs/authsome/authentication/oauth2-provider.md): Run Authsome as an OAuth2 authorization server with Authorization Code, PKCE, and Client Credentials flows.
- [Authentication Overview](https://www.xraph.com/docs/authsome/authentication/overview.md): How Authsome's strategy-based auth system works, and how plugins contribute authentication methods.
- [Passkeys (WebAuthn)](https://www.xraph.com/docs/authsome/authentication/passkeys.md): FIDO2/WebAuthn-based passwordless authentication with biometrics and hardware security keys.
- [Password Authentication](https://www.xraph.com/docs/authsome/authentication/password.md): Password-based sign-up, sign-in, and account management with bcrypt or argon2id hashing.
- [Phone Authentication](https://www.xraph.com/docs/authsome/authentication/phone-auth.md): SMS-based phone number verification and passwordless sign-in via one-time codes.
- [Social Login](https://www.xraph.com/docs/authsome/authentication/social-login.md): OAuth2 social sign-in with Google, GitHub, Microsoft, and Apple.
- [Enterprise SSO](https://www.xraph.com/docs/authsome/authentication/sso.md): OIDC and SAML-based enterprise single sign-on with JIT user provisioning.
- [Chronicle Bridge](https://www.xraph.com/docs/authsome/bridges/chronicle.md): Audit logging integration that records every auth event to a Chronicle backend.
- [Dispatch Bridge](https://www.xraph.com/docs/authsome/bridges/dispatch.md): Background job processing — offloads async tasks like email sending and session cleanup to Dispatch.
- [Herald Bridge](https://www.xraph.com/docs/authsome/bridges/herald.md): Advanced multi-channel notification delivery via Herald, replacing the separate Mailer and SMS bridges.
- [Keysmith Bridge](https://www.xraph.com/docs/authsome/bridges/keysmith.md): Centralized API key management — delegates key operations to Keysmith for rate limiting, scoping, and rotation.
- [Ledger Bridge](https://www.xraph.com/docs/authsome/bridges/ledger.md): Billing and metering integration — tracks auth usage events and checks feature entitlements via Ledger.
- [Mailer Bridge](https://www.xraph.com/docs/authsome/bridges/mailer.md): Transactional email delivery for verification, password resets, magic links, and invitations.
- [Metrics Bridge](https://www.xraph.com/docs/authsome/bridges/metrics.md): Observability integration — emits authentication metrics to Prometheus, OpenTelemetry, or any collector backend.
- [Bridges](https://www.xraph.com/docs/authsome/bridges/overview.md): Optional integration adapters that connect Authsome to the broader Forgery ecosystem.
- [Relay Bridge](https://www.xraph.com/docs/authsome/bridges/relay.md): Reliable webhook delivery — sends auth event payloads to Relay for fan-out with retry semantics.
- [SMS Bridge](https://www.xraph.com/docs/authsome/bridges/sms.md): SMS delivery for OTP codes, MFA verification, and phone number verification.
- [Vault Bridge](https://www.xraph.com/docs/authsome/bridges/vault.md): Secret management and feature flag integration via the Vault extension.
- [Warden Bridge](https://www.xraph.com/docs/authsome/bridges/warden.md): Advanced RBAC engine — delegates permission checks to Warden for richer RBAC, ReBAC, and ABAC policy evaluation.
- [Configuration](https://www.xraph.com/docs/authsome/concepts/configuration.md): All configuration options for the Authsome engine, sessions, passwords, rate limiting, and lockout.
- [Entities](https://www.xraph.com/docs/authsome/concepts/entities.md): Core data types used across Authsome — users, sessions, organizations, devices, and more.
- [Errors](https://www.xraph.com/docs/authsome/concepts/errors.md): Sentinel error values, API error response format, and error handling patterns.
- [Identity (TypeID)](https://www.xraph.com/docs/authsome/concepts/identity.md): How Authsome uses prefix-qualified, globally unique identifiers for every entity.
- [Multi-Tenancy](https://www.xraph.com/docs/authsome/concepts/multi-tenancy.md): How Authsome scopes every entity to an app, and how organizations and environments add further isolation layers.
- [Branding](https://www.xraph.com/docs/authsome/dynamic-forms/branding.md): Customize auth page appearance with logos, colors, fonts, and CSS overrides per organization.
- [Custom Form Schemas](https://www.xraph.com/docs/authsome/dynamic-forms/custom-schemas.md): Define dynamic signup forms with custom fields, validation rules, and per-app configuration using FormConfig.
- [Form Editor](https://www.xraph.com/docs/authsome/dynamic-forms/form-editor.md): Visual dashboard editor for building and previewing custom signup forms without code.
- [Environment Cloning](https://www.xraph.com/docs/authsome/environments/cloning.md): Clone an existing environment's configuration to create a new environment, without copying user data.
- [Environments Overview](https://www.xraph.com/docs/authsome/environments/overview.md): Application environments for isolating development, staging, and production authentication data and configuration.
- [Per-Environment Isolation](https://www.xraph.com/docs/authsome/environments/per-env-isolation.md): How Authsome enforces strict data isolation between environments, including users, sessions, organizations, and per-environment session configuration.
- [Getting Started](https://www.xraph.com/docs/authsome/getting-started.md): Install Authsome and run your first auth flow in five minutes.
- [Custom Plugin](https://www.xraph.com/docs/authsome/guides/custom-plugin.md): Build a custom Authsome plugin by implementing lifecycle hook interfaces.
- [Custom Store](https://www.xraph.com/docs/authsome/guides/custom-store.md): Implement a custom storage backend by satisfying the composite store.Store interface.
- [Forge Extension](https://www.xraph.com/docs/authsome/guides/forge-extension.md): Mount Authsome into a Forge application as a first-class extension with automatic dependency discovery and route registration.
- [Full Example](https://www.xraph.com/docs/authsome/guides/full-example.md): Complete standalone Authsome server with PostgreSQL, all plugins, and bridge setup.
- [Migration Guide](https://www.xraph.com/docs/authsome/guides/migration-guide.md): Migrate to Authsome from Firebase Auth, Auth0, Supabase Auth, or custom JWT implementations.
- [Next.js App Guide](https://www.xraph.com/docs/authsome/guides/nextjs-app.md): Build a complete Next.js application with Authsome UI -- authentication, route protection, and user management.
- [Introduction](https://www.xraph.com/docs/authsome.md): Production-grade authentication & identity platform for Go.
- [Invitations](https://www.xraph.com/docs/authsome/organizations/invitations.md): Email-based invitation flow for adding members to organizations, with token lifecycle and status tracking.
- [Members](https://www.xraph.com/docs/authsome/organizations/members.md): Manage organization membership with three built-in roles and full CRUD operations.
- [Organization-Scoped Roles](https://www.xraph.com/docs/authsome/organizations/org-scoped-roles.md): RBAC role assignments scoped to a specific organization, layered on top of global roles.
- [Organizations Overview](https://www.xraph.com/docs/authsome/organizations/overview.md): Multi-tenant organization management with CRUD operations, org-scoped features, and plugin-based setup.
- [Teams](https://www.xraph.com/docs/authsome/organizations/teams.md): Sub-groups within organizations for delegated access control and resource assignment.
- [API Key Plugin](https://www.xraph.com/docs/authsome/plugins/apikey.md): API key generation, scoped permissions, rotation, revocation, and bearer token authentication strategy.
- [Consent Plugin](https://www.xraph.com/docs/authsome/plugins/consent.md): GDPR-compliant consent management with grant, revoke, audit trail, and data export.
- [Creating Custom Plugins](https://www.xraph.com/docs/authsome/plugins/creating-plugins.md): Step-by-step guide to building custom Authsome plugins with strategies, hooks, migrations, and routes.
- [Device Plugin](https://www.xraph.com/docs/authsome/plugins/device.md): Device fingerprinting, trust management, session-device binding, and suspicious device detection.
- [Email Plugin](https://www.xraph.com/docs/authsome/plugins/email.md): Email verification and transactional email notifications via the Mailer bridge.
- [Magic Link Plugin](https://www.xraph.com/docs/authsome/plugins/magiclink.md): Passwordless authentication via time-limited magic links delivered by email.
- [MFA Plugin](https://www.xraph.com/docs/authsome/plugins/mfa.md): Multi-factor authentication with TOTP, SMS OTP, recovery codes, and challenge flows.
- [Notification Plugin](https://www.xraph.com/docs/authsome/plugins/notification.md): Multi-channel notifications via Herald bridge with event-driven templates for email, SMS, and in-app messaging.
- [OAuth2 Provider Plugin](https://www.xraph.com/docs/authsome/plugins/oauth2provider.md): Turn Authsome into an OAuth2 authorization server with Authorization Code + PKCE, Client Credentials, OIDC discovery, and client management.
- [Organization Plugin](https://www.xraph.com/docs/authsome/plugins/organization.md): Multi-tenant organization management with members, teams, invitations, and role-based access control.
- [Plugin Architecture](https://www.xraph.com/docs/authsome/plugins/overview.md): How Authsome's plugin system extends the engine with authentication strategies, hooks, routes, and migrations.
- [Passkey Plugin](https://www.xraph.com/docs/authsome/plugins/passkey.md): FIDO2/WebAuthn passkey registration and authentication with resident keys and platform authenticators.
- [Password Plugin](https://www.xraph.com/docs/authsome/plugins/password.md): Password-based authentication with bcrypt or argon2id hashing, password policies, breach checking, and account lifecycle management.
- [Phone Plugin](https://www.xraph.com/docs/authsome/plugins/phone.md): Phone number verification and OTP-based authentication with automatic user provisioning.
- [Social Login Plugin](https://www.xraph.com/docs/authsome/plugins/social.md): OAuth2 social authentication with Google, GitHub, Microsoft, Apple, and custom providers.
- [SSO Plugin](https://www.xraph.com/docs/authsome/plugins/sso.md): Enterprise Single Sign-On via OIDC and SAML with per-organization provider configuration and domain-based routing.
- [Audit Trail](https://www.xraph.com/docs/authsome/security/audit-trail.md): Append-only security event log with IP and user agent recording, time-range queries, cursor pagination, and Chronicle bridge integration.
- [IP Access Control](https://www.xraph.com/docs/authsome/security/ip-control.md): IP whitelist and blacklist configuration for application-level access control, and session IP binding for session hijacking prevention.
- [Account Lockout](https://www.xraph.com/docs/authsome/security/lockout.md): Configurable failed-attempt tracking and automatic account lockout to defend against brute-force attacks.
- [Rate Limiting](https://www.xraph.com/docs/authsome/security/rate-limiting.md): Per-endpoint rate limits with configurable windows, memory and noop built-in limiters, and a pluggable interface for Redis or custom backends.
- [Role-Based Access Control](https://www.xraph.com/docs/authsome/security/rbac.md): Hierarchical role and permission management with global and organization-scoped assignments, Warden integration, and RBAC middleware.
- [Webhooks](https://www.xraph.com/docs/authsome/security/webhooks.md): Configure webhook endpoints to receive real-time notifications for all 31 Authsome events, with HMAC signing and Relay bridge integration.
- [Memory Store](https://www.xraph.com/docs/authsome/stores/memory.md): In-memory store for unit tests, integration tests, and local development without a database.
- [MongoDB](https://www.xraph.com/docs/authsome/stores/mongodb.md): MongoDB backend for teams operating a document-oriented data platform.
- [Store Backends](https://www.xraph.com/docs/authsome/stores/overview.md): How Authsome persists authentication data across PostgreSQL, SQLite, MongoDB, and Memory backends.
- [PostgreSQL](https://www.xraph.com/docs/authsome/stores/postgres.md): Production-grade PostgreSQL backend using Grove ORM with pgdriver.
- [SQLite](https://www.xraph.com/docs/authsome/stores/sqlite.md): Lightweight embedded SQLite backend using Grove ORM with sqlitedriver.
- [Styled Components](https://www.xraph.com/docs/authsome/ui/components.md): 40+ pre-styled authentication components built with Radix UI and Tailwind CSS via @authsome/ui-components.
- [Flutter UI](https://www.xraph.com/docs/authsome/ui/flutter.md): Pre-built Material Design 3 authentication screens and widgets for Flutter.
- [Next.js Integration](https://www.xraph.com/docs/authsome/ui/nextjs.md): Server sessions, Edge middleware, API proxy, cookie storage, and pre-built pages for Next.js via @authsome/ui-nextjs.
- [Authsome UI Overview](https://www.xraph.com/docs/authsome/ui/overview.md): Pre-built authentication UI components for React, Next.js, and Vue — headless hooks plus styled Radix + Tailwind components.
- [Playground](https://www.xraph.com/docs/authsome/ui/playground.md): Interactive Storybook playground for exploring and testing all Authsome UI components.
- [React Integration](https://www.xraph.com/docs/authsome/ui/react.md): AuthProvider, hooks, and headless components for React applications using @authsome/ui-react.
- [Vue Integration](https://www.xraph.com/docs/authsome/ui/vue.md): Vue 3 composables and plugin for Authsome authentication via @authsome/ui-vue.
- [Device Tracking](https://www.xraph.com/docs/authsome/users-sessions/device-tracking.md): Device fingerprinting, trusted device management, and session-device binding.
- [Impersonation](https://www.xraph.com/docs/authsome/users-sessions/impersonation.md): Admin impersonation of user accounts with full audit trail and security controls.
- [Session Lifecycle](https://www.xraph.com/docs/authsome/users-sessions/session-lifecycle.md): Session creation, token generation, refresh, revocation, and concurrent session management.
- [Token Formats](https://www.xraph.com/docs/authsome/users-sessions/token-formats.md): Opaque tokens vs JWT, claims structure, OIDC compatibility, JWKS endpoint, and per-app token configuration.
- [User Management](https://www.xraph.com/docs/authsome/users-sessions/user-management.md): User entity structure, CRUD operations, profile management, metadata, banning, and search.