auth.is documentation
auth.is gives every team its own hosted OpenID Connect provider on a *.auth.is subdomain — created, configured, themed, and operated through an MCP server that your AI tools talk to. You describe what you want ("create a team for acme.com, add a public client for our SPA, and brand the login page teal") and the tools do it against a real, standards-compliant issuer.
There is no dashboard you have to learn first. The management surface is a set of MCP tools; the login surface is a normal OIDC issuer your apps integrate with over plain OAuth 2.0 + OpenID Connect.
What you get
- A dedicated issuer at
https://yourteam.auth.isserving OIDC discovery, JWKS, and the authorization/token/userinfo endpoints — its own signing keys and its own user pool. - Clients (applications) you register against that issuer: confidential servers or public PKCE apps.
- Federation — "Continue with Google / Microsoft / Kenni" buttons, per issuer.
- Theming from a single accent color: full light + dark palettes, generated and contrast-checked.
- Passkeys, refresh tokens, key rotation, and team membership — all managed conversationally.
How the pieces fit
You manage everything through mcp.auth.is. The MCP server exchanges your token (RFC 8693) for one bound to the management API and relays your request to it, which configures your issuer. Your applications never touch the MCP — they speak OIDC directly to yourteam.auth.is, exactly as they would with any OpenID Connect provider.
Who it is for
Teams that want a real, dedicated OIDC provider without standing up and operating one — and who would rather set it up by describing it to an AI assistant than clicking through an admin console. If your stack already speaks OpenID Connect (better-auth, NextAuth, openid-client, Spring Security, AddOpenIdConnect, Authlib, …), it already speaks auth.is.