SPRODexisContext Manager
Hrida Auth as a ServiceCustom Fine-Tuned ModelsOpen Source ModelsPersonalized AI AgentsLLM RAG ApplicationsOn-Premise LLM Deployment
Blogs
About Hrida AIBlogs
Identity as a Service

One login. Every product.

HridaAuth is the central identity provider for all Hrida AI products. Sign in once, access everything - built on OAuth 2.0, OIDC, and enterprise-grade security.

OAuth 2.0OIDCPKCEJWKSM2MSSO

Sign-in Methods

Every way to authenticate.
Already built.

Social login, magic links, OTP, and enterprise SSO - all configured per product, no extra setup.

Google

Sign in with Google Workspace or personal accounts. Works with domain-based org routing.

GitHub

Authenticate developers with their GitHub identity, orgs, and team memberships.

Microsoft

Connect Azure AD tenants or personal Microsoft accounts via OIDC redirect.

LinkedIn

Professional identity via LinkedIn OAuth 2.0. Ideal for B2B product onboarding.

Apple

Privacy-first Sign in with Apple, including private email relay support.

Enterprise SSO

Bring-your-own IdP via OIDC. Automatic routing by company email domain.

Email & Password

Argon2-hashed passwords with account lockout after repeated failures.

Magic Link

Passwordless email login - request a link, click, done. No password required.

OTP Verification

Email OTP used at registration, login, and sensitive action verification.

OAuth 2.0 & OIDC

Standards-based tokens.
Drop-in for any product.

HridaAuth acts as a full OAuth 2.0 authorization server and OpenID Connect provider. Your products verify tokens with a single JWKS call.

Integrate in minutes

Authorization code flow with PKCE

1"color:var(--color-muted-foreground)">// 1. Build the authorize URL
2const url = new URL(
3 "https:">//auth.hridaai.com/v1/oauth/authorize"
4)
5url.searchParams.set("client_id", CLIENT_ID)
6url.searchParams.set("response_type", "code")
7url.searchParams.set("code_challenge", challenge)
8url.searchParams.set("code_challenge_method", "S256")
9redirect(url.toString())
10
11"color:var(--color-muted-foreground)">// 2. Exchange code -> tokens
12const { access_token } = await fetch(
13 "https:">//auth.hridaai.com/v1/oauth/token",
14 { method: "POST",
15 body: JSON.stringify({ code, code_verifier }) }
16).then(r => r.json())

Standards

What's built

  • Authorization code + PKCE (S256)
  • OIDC discovery endpoint
  • JWKS & asymmetric per-client keys
  • ID tokens & userinfo endpoint
  • Refresh tokens
  • Machine-to-machine (M2M)
  • Consent screen (oauth_consents)
  • Token revocation (RFC 7009)
  • Dynamic client reg (RFC 7591)
  • Resource indicators for MCP

Tokens

JWT access token

1{
2 "sub": "usr_8f3k2j9",
3 "email": "jane@acme.com",
4 "pid": "spro",
5 "tenant": "acme_corp",
6 "role_name": "admin",
7 "scopes": ["models:read","gateway:write"],
8 "iss": "https:">//auth.hridaai.com",
9 "exp": 1735689600
10}

Flow

Authorization flow

01

User clicks "Sign in"

Your product redirects to HridaAuth with client_id, PKCE challenge, and redirect_uri.

02

User authenticates

HridaAuth handles login - password, OTP, social, or SSO - and records an audit event.

03

Code returned to your app

HridaAuth redirects back with an authorization code. Your backend exchanges it for tokens.

04

Token verified by product

Your product validates the JWT using JWKS. Claims include user ID, role, scopes, and tenant.

Security

Enterprise security.
Zero config.

Every account gets hardened by default. No toggles, no tiers - Argon2 hashing, rate limiting, audit logs, and IP-based threat detection come built in.

PKCE

Enforced on all flows

5+

Social providers

100%

Audit coverage

OIDC

Compliant SSO

Argon2 password hashingBuilt
Breached password check (HIBP)Built
Disposable email blockingBuilt
Account lockout after failuresBuilt
Rate limiting per IP (escalating)Built
Audit log for all auth eventsBuilt
Login history with IP & locationBuilt
Server-side session managementBuilt

Ready to ship auth
the right way?

Integrate HridaAuth into your product and stop building auth from scratch. Book a demo to get started.