MayoStart small. Own it.
The public website offers a browser-only sample workspace. The Community repository contains the real self-hosted OIDC server, administration API, console, and CLI.
Run the Community server
Requires Node.js 24 LTS. No vendor account is needed. Choose an instance directory on
persistent storage. The default is a private .mayoauth directory in your
working folder.
git clone https://github.com/securelyprogramming/MayoAuth.git cd MayoAuth npm ci npm link # Bash: read a password without echo or command history read -r -s -p "Admin password: " MAYOAUTH_INIT_PASSWORD printf '%s' "$MAYOAUTH_INIT_PASSWORD" | mayoauth init \ --issuer http://localhost:8787 \ --admin-email admin@example.test --password-stdin unset MAYOAUTH_INIT_PASSWORD mayoauth serve # Open http://localhost:8787/login
The issuer must exactly match the origin that applications use. For a deployed instance, initialize with its HTTPS origin. Do not change the issuer of an active instance casually. Instance keys, encrypted-connector keys, and the local CLI token are saved with private file permissions.
One console. One API. One CLI.
mayoauth status mayoauth doctor mayoauth users list mayoauth apps add --name "My app" \ --redirect-uri http://localhost:3000/callback mayoauth connectors list mayoauth logs --export > audit.json mayoauth --help
Use --data-dir to select an instance. For a remote server, set
MAYOAUTH_URL and MAYOAUTH_TOKEN in a private environment.
Passwords and connector secrets are accepted on stdin, never as command arguments.
Remote CLI connections require HTTPS.
The CLI is installed from the repository today. There is no published npm package or shell installer to download yet.
Standard OIDC, explicit trust
Discovery is at /.well-known/openid-configuration. The issuer supports
authorization code with required PKCE S256, signed ID tokens, a JWKS endpoint, consent,
and userinfo. Applications use exact registered callback URLs. Public dynamic
registration is disabled.
Upstream connectors use openid-client to validate state, nonce, PKCE, and
tokens. Configure the callback as INSTANCE_ORIGIN/connectors/callback. An
administrator must map the upstream provider’s immutable sub to an existing
local user. MayoAuth never auto-links accounts just because email addresses match.
Google, Microsoft, GitHub, and other named providers are not individually certified in this beta. A generic OIDC connector must be tested with your own tenant before use. GitHub’s regular OAuth login is not itself a generic OIDC provider.
Bounded by design
| Resource | Default boundary |
|---|---|
| SQLite main database | 256 MiB, enforced with max_page_count |
| SQLite page cache | 8 MiB configured cache budget |
| Audit history | 10,000 events / 30 days, whichever expires first |
| OIDC transient records | 10,000 rows, with expiry cleanup |
| Container | 256 MiB memory, 0.5 CPU, 80 processes |
| Temporary filesystem / logs | 16 MiB tmpfs / 2 × 5 MiB log files |
The beta uses one SQLite process with DELETE journaling. The database-file cap excludes rollback journals, backups, and filesystem overhead. The page-cache setting is a budget, not a total-process memory limit; the container enforces the latter. Allow at least 1 GiB of dedicated storage headroom and apply a host filesystem quota for a hard directory-level ceiling. A full database rejects writes; it never silently removes identities.
Use mayoauth status or the console’s storage panel to inspect usage. The
public website/demo creates no server-side identity database.
The Community / Premium boundary
| Capability | Community beta | Managed Premium plan |
|---|---|---|
| OIDC, users, connectors, CLI | Included | Same foundation |
| Audit export & basic metrics | Included | Longer managed retention & alerts |
| User count | No license cap | Managed capacity beyond planned 20-user free tier |
| Hosting, updates, backups | You operate | We operate |
| Support & availability | Community issues | Planned priority support and service commitments |
Cloud Free and Premium are planned services. No hosted production tenants, subscription checkout, or payments are implemented. The public demo is not the future Cloud service. We have not set Premium pricing.
Beta means beta.
Implemented: single-instance OIDC, local passwords, explicit upstream OIDC account linking, user suspension, application registration, bounded audit data, basic metrics, console, and CLI.
Not implemented: built-in MFA/passkeys, account self-service or recovery, email delivery/verification, SAML, SCIM, directory synchronization, refresh-token flows, distributed deployment, managed tenant isolation, billing, or support SLAs. Built-in MFA belongs in Community when implemented.
Account suspension revokes persisted sessions and grants. Already issued ID tokens may remain verifiable until their short expiry; relying applications must enforce their own sessions and revocation strategy. This beta is not a full Okta replacement.
Keep the demo synthetic
The demo saves sample users, apps, connectors, and events in your browser’s local
storage. Use sample addresses ending in @example.test. It never creates
real accounts, contacts identity providers, sends email, or issues identity tokens.
Resetting the demo removes this sample data.
The site has no analytics scripts, tracking cookies, or third-party fonts. The hosting reverse proxy may retain normal request logs. Self-hosted instance data remains on the infrastructure you operate.