Identity you host. For people and for agents.
Identity you host. For people and for agents.
Identity you host. For people and for agents.
A complete OpenID provider on .NET 10: passkeys first, OAuth 2.1 with no legacy grants at all, human approval for what an agent does on your behalf — and ready-made screens under your brand.
Unlimitedusers — priced per installation
0implicit, hybrid or ROPC
RFC 9700audited with executable tests
AGENT APPROVAL
Pay invoice 2026-0842 to Contoso — £930.00
Approve
Deny
Sign in with a passkey
or
E-mail or username
ada@example.com
Continue
Sign in with a link instead
The real screens — rebrand them, or turn them off.
Identity you host. For people and for agents.
Identity you host. For people and for agents.
Identity you host. For people and for agents.
A complete OpenID provider on .NET 10: passkeys first, OAuth 2.1 with no legacy grants at all, human approval for what an agent does on your behalf — and ready-made screens under your brand.
Unlimitedusers — priced per installation
0implicit, hybrid or ROPC
RFC 9700audited with executable tests
AGENT APPROVAL
Pay invoice 2026-0842 to Contoso — £930.00
Approve
Deny
Sign in with a passkey
or
E-mail or username
ada@example.com
Continue
Sign in with a link instead
The real screens — rebrand them, or turn them off.
WHAT'S IN THE BOXAgent-readyAI agents are first-class clients — and the person stays the one who decides.CIBARFC 9396RFC 8693RFC 7591 · 9728Passwordless-firstPasskeys as the primary credential. Passwords are supported, never required.OTPOAuth 2.1 as the baselineSecure by default, not by configuration. No legacy grant — not even behind a flag.RFC 8628RFC 8705Fine-grained authorisationAuthority may only narrow, never widen — and a widening request is refused, not trimmed.RFC 7644Agent-readyAI agents are first-class clients — and the person stays the one who decides.CIBARFC 9396RFC 8693RFC 7591 · 9728Passwordless-firstPasskeys as the primary credential. Passwords are supported, never required.OTPOAuth 2.1 as the baselineSecure by default, not by configuration. No legacy grant — not even behind a flag.RFC 8628RFC 8705Fine-grained authorisationAuthority may only narrow, never widen — and a widening request is refused, not trimmed.RFC 7644
Four pillars. None of them bolted on later.
Four pillars. None of them bolted on later.
Four pillars. None of them bolted on later.
Everything below ships today and is integration-tested. What is still roadmap, or needs the commercial licence, says so.
Asynchronous human approval, binding message up front
COMMERCIAL
Per-transaction intent, not standing access
COMMERCIAL
"On behalf of" delegation, act chain in the token
COMMERCIAL
Dynamic registration and resource metadata — MCP-server ready
COMMERCIAL
Passkeys with verification required — AAL2 in one gesture
WebAuthn
Magic link, e-mail code and SMS code
COMMERCIAL
Authenticator app and recovery codes, step-up by the flow engine
RFC 6238
Argon2id passwords and self-service recovery
RFC 9106
Mandatory PKCE, S256 only — plain is refused
RFC 7636
Rotating refresh — reuse revokes the whole family
RFC 9700
Device flow for TVs and CLIs
COMMERCIAL
Certificate-bound tokens (mTLS) for FAPI 2.0
COMMERCIAL
Statement permissions and roles, evaluated into the token
resource:action
Organisations, invitations and SCIM — a token speaks for exactly one
COMMERCIAL
Per-organisation SSO, routed by verified domain
COMMERCIAL
Zanzibar-style relationships (OpenFGA / Ory Keto)
ROADMAP
Asynchronous human approval, binding message up front
COMMERCIAL
Per-transaction intent, not standing access
COMMERCIAL
"On behalf of" delegation, act chain in the token
COMMERCIAL
Dynamic registration and resource metadata — MCP-server ready
COMMERCIAL
Passkeys with verification required — AAL2 in one gesture
WebAuthn
Magic link, e-mail code and SMS code
COMMERCIAL
Authenticator app and recovery codes, step-up by the flow engine
RFC 6238
Argon2id passwords and self-service recovery
RFC 9106
Mandatory PKCE, S256 only — plain is refused
RFC 7636
Rotating refresh — reuse revokes the whole family
RFC 9700
Device flow for TVs and CLIs
COMMERCIAL
Certificate-bound tokens (mTLS) for FAPI 2.0
COMMERCIAL
Statement permissions and roles, evaluated into the token
resource:action
Organisations, invitations and SCIM — a token speaks for exactly one
COMMERCIAL
Per-organisation SSO, routed by verified domain
COMMERCIAL
Zanzibar-style relationships (OpenFGA / Ory Keto)
ROADMAP
STANDARDS & CONFORMANCE
External certification, not feature count.
External certification, not feature count.
External certification, not feature count.
Every deviation from a standard gets an ADR. Every server-side MUST has a test that proves it.
PROTOCOL
OpenID Connect
Core 1.0
PKCE · S256
RFC 7636
Pushed requests
RFC 9126
Dynamic registration
RFC 7591/7592
Token exchange
RFC 8693
Rich authorization
RFC 9396
Device authorization
RFC 8628
Backchannel (CIBA)
poll
CREDENTIALS & SIGNALS
Passkeys
WebAuthn L2
TOTP
RFC 6238
Argon2id
OWASP params
Security events
RFC 8417
Shared Signals · CAEP
RFC 8935
Problem details
RFC 9457
ENTERPRISE
SCIM 2.0 · Users
RFC 7644
Resource metadata
RFC 9728
Mutual-TLS tokensRFC 8705
COMMERCIAL
Per-org SSO
COMMERCIAL
Signed webhooks
HMAC t,v1
AUDITS
OAuth Security BCP
AUDITED
OWASP ASVS 5.0 · V6 V7
AUDITED
OpenID certification
SUITE PENDING
FAPI 2.0 Security Profile
SUITE PENDING
Every finding of the gap analysis is fixed or decided; what remains is running the official suites.
PROTOCOL
OpenID Connect
Core 1.0
PKCE · S256
RFC 7636
Pushed requests
RFC 9126
Dynamic registration
RFC 7591/7592
Token exchange
RFC 8693
Rich authorization
RFC 9396
Device authorization
RFC 8628
Backchannel (CIBA)
poll
CREDENTIALS & SIGNALS
Passkeys
WebAuthn L2
TOTP
RFC 6238
Argon2id
OWASP params
Security events
RFC 8417
Shared Signals · CAEP
RFC 8935
Problem details
RFC 9457
ENTERPRISE
SCIM 2.0 · Users
RFC 7644
Resource metadata
RFC 9728
Mutual-TLS tokensRFC 8705
COMMERCIAL
Per-org SSO
COMMERCIAL
Signed webhooks
HMAC t,v1
AUDITS
OAuth Security BCP
AUDITED
OWASP ASVS 5.0 · V6 V7
AUDITED
OpenID certification
SUITE PENDING
FAPI 2.0 Security Profile
SUITE PENDING
Every finding of the gap analysis is fixed or decided; what remains is running the official suites.
PROTOCOL
OpenID Connect
Core 1.0
PKCE · S256
RFC 7636
Pushed requests
RFC 9126
Dynamic registration
RFC 7591/7592
Token exchange
RFC 8693
Rich authorization
RFC 9396
Device authorization
RFC 8628
Backchannel (CIBA)
poll
CREDENTIALS & SIGNALS
Passkeys
WebAuthn L2
TOTP
RFC 6238
Argon2id
OWASP params
Security events
RFC 8417
Shared Signals · CAEP
RFC 8935
Problem details
RFC 9457
ENTERPRISE
SCIM 2.0 · Users
RFC 7644
Resource metadata
RFC 9728
Mutual-TLS tokensRFC 8705
COMMERCIAL
Per-org SSO
COMMERCIAL
Signed webhooks
HMAC t,v1
AUDITS
OAuth Security BCP
AUDITED
OWASP ASVS 5.0 · V6 V7
AUDITED
OpenID certification
SUITE PENDING
FAPI 2.0 Security Profile
SUITE PENDING
Every finding of the gap analysis is fixed or decided; what remains is running the official suites.
PROTOCOL
OpenID Connect
Core 1.0
PKCE · S256
RFC 7636
Pushed requests
RFC 9126
Dynamic registration
RFC 7591/7592
Token exchange
RFC 8693
Rich authorization
RFC 9396
Device authorization
RFC 8628
Backchannel (CIBA)
poll
CREDENTIALS & SIGNALS
Passkeys
WebAuthn L2
TOTP
RFC 6238
Argon2id
OWASP params
Security events
RFC 8417
Shared Signals · CAEP
RFC 8935
Problem details
RFC 9457
ENTERPRISE
SCIM 2.0 · Users
RFC 7644
Resource metadata
RFC 9728
Mutual-TLS tokensRFC 8705
COMMERCIAL
Per-org SSO
COMMERCIAL
Signed webhooks
HMAC t,v1
AUDITS
OAuth Security BCP
AUDITED
OWASP ASVS 5.0 · V6 V7
AUDITED
OpenID certification
SUITE PENDING
FAPI 2.0 Security Profile
SUITE PENDING
Every finding of the gap analysis is fixed or decided; what remains is running the official suites.
QUICK START
Running in two commands.
Running in two commands.
Running in two commands.
Once you have access to the feed: no licence key outside production. Migrations run on their own and a development M2M client is seeded for you.
localhost:5180/scalar— API reference
samples/…WebPages.Sample— the screens under your brand, no database
zsh — equantic-auth
# 1. PostgreSQL
$ docker compose up -d# 2. The API — applies migrations, seeds the dev client
$ dotnet run --project samples/eQuantic.Auth.Api.Sample# 3. Done
$ curl localhost:5180/.well-known/openid-configuration{ "issuer": "http://localhost:5180/", "code_challenge_methods_supported": ["S256"], … }QUICK START
Running in two commands.
Running in two commands.
Running in two commands.
Once you have access to the feed: no licence key outside production. Migrations run on their own and a development M2M client is seeded for you.
localhost:5180/scalar— API reference
samples/…WebPages.Sample— the screens under your brand, no database
zsh — equantic-auth
# 1. PostgreSQL
$ docker compose up -d# 2. The API — applies migrations, seeds the dev client
$ dotnet run --project samples/eQuantic.Auth.Api.Sample# 3. Done
$ curl localhost:5180/.well-known/openid-configuration{ "issuer": "http://localhost:5180/", "code_challenge_methods_supported": ["S256"], … }COMPARE
eQuantic.AuthBased on each vendor's public documentation as of September 2026. Trademarks belong to their owners.
Where it fits.
Where it fits.
Where it fits.
Choosing an identity provider is choosing where it runs, who holds the data and what makes the price grow.
eQuantic.AuthKeycloak
Duende IdentityServer
Auth0
Zitadel
DELIVERY
Server you host
Server you host
Framework inside your ASP.NET Core app
Managed SaaS
Self-hosted or their cloud
RUNTIME
.NET 10
Java · Quarkus
.NET
—
Go
LOGIN SCREENS
Ready-made, your brand, optional
FreeMarker themes
You build them, from templates
Universal Login
Hosted login
LICENCE
Free core · annual commercial modules
Apache 2.0
Commercial, free edition for small companies
Subscription
AGPL-3.0
PRICE GROWS WITH
Production installations — never users
Free; paid support separately
Edition and company size
Monthly active users
Usage, in their cloud
WHERE YOUR USERS LIVE
Your infrastructure
Your infrastructure
Your infrastructure
The vendor's cloud
Wherever you choose
PRICINGBilled yearly · card or invoice · key issued instantlyBilled yearly · card or invoice · key issued instantly
The core is free. The modules are licensed.
The core is free. The modules are licensed.
The core is free. The modules are licensed.
The core is free for any use, commercial included. The commercial licence adds the modules, per production installation — users are never counted.
CommunityFreeThe core, for any useEverything a sign-in needs, for your company too. In production it runs under a free Community key.
OpenID Connect and OAuth 2.1, accounts and sessions
Passkeys, authenticator app and recovery codes
Roles and permissions, the audit log and the eqa CLI
Hosted screens under your name and logo
Every module unlocked outside production
Request access
Commercial
COMMERCIAL MODULES
£1,190
per production installation, per yearEverything in Community, and the modules your key switches on.example price
AI agents: device flow, CIBA, token exchange, dynamic registration
Passwordless sign-in: magic link, e-mail and SMS codes
Organisations, invitations, per-organisation SSO and SCIM
Webhooks and hooks, white-label, risk signals, mTLS and FAPI 2.0
SLA support — reply within 1 working day
Coming: multi-tenant realms and per-organisation branding
Buy a licence
CommunityFreeThe core, for any useEverything a sign-in needs, for your company too. In production it runs under a free Community key.
OpenID Connect and OAuth 2.1, accounts and sessions
Passkeys, authenticator app and recovery codes
Roles and permissions, the audit log and the eqa CLI
Hosted screens under your name and logo
Every module unlocked outside production
Request access
Commercial
COMMERCIAL MODULES
£1,190
per production installation, per yearEverything in Community, and the modules your key switches on.example price
AI agents: device flow, CIBA, token exchange, dynamic registration
Passwordless sign-in: magic link, e-mail and SMS codes
Organisations, invitations, per-organisation SSO and SCIM
Webhooks and hooks, white-label, risk signals, mTLS and FAPI 2.0
SLA support — reply within 1 working day
Coming: multi-tenant realms and per-organisation branding
Buy a licence
What is an installation? One production issuer. Replicas behind the same issuer count as one; development, staging and CI don't count.
LICENSING
Straight questions, short answers.
Straight questions, short answers.
Straight questions, short answers.
The core, for any use, commercial included: OpenID Connect and OAuth 2.1, accounts and sessions, passkeys, the authenticator app and recovery codes, roles and permissions, the audit log, and the hosted screens under your name and logo.
