Auth

What it does

• Sign people in with email links and passkeys
• Keep a directory of people, sign-in methods and activity
• Link compatible apps so one sign-in works across them
• Recover accounts with another administrator's approval, a 72-hour delay, or a local emergency token
• Sign people out of every linked app at once
• Let an agent prepare administration changes for an administrator to approve
• Export and restore the whole installation
• Stage a user list from Google Workspace, Microsoft Entra, Auth0, Okta or JumpCloud for review before inviting people

What it promises

• AUTH-HOST-001The host you choose owns sign-in and passkeys; changing it is a provider move that needs each app's owner to approve re-linking.
• AUTH-PRIVACY-001Auth shares each person's email and name with the apps they use.
• AUTH-IDENTITY-001Email-link proof completes only in the browser that asked for it, and administration needs a hardware passkey plus a fresh email confirmation.
• AUTH-IDENTITY-001Recovery requires another administrator's approval, a cancellable notified 72-hour delay, or the local emergency recovery token.
• AUTH-PROTOCOL-001Access tokens are short-lived, last at most five minutes, and work only for reading the person's own identity details.
• AUTH-MOVEIN-001People staged from another provider cannot sign in or receive mail until you admit them, and admission carries no password, passkey, role or session.
• AUTH-ADMIN-001An agent only prepares administration work and a person decides; its key is shown once and expires after 30 days.
• AUTH-LOGOUT-001Signing out everywhere or suspending a person tells each linked app to end their session, retrying for up to 24 hours.
• AUTH-RER-TRUST-001An install that trusts no RER key makes no request to RER.
• AUTH-TRANSFER-001Exports leave out sessions and private keys.

Move in from

• Google Workspace
• Microsoft Entra
• Auth0
• Okta
• JumpCloud

Run it yourself

Install the command once, then clone a product and start it.

$ npx -y @runeditrun/rer cli install
$ git clone https://github.com/just-every/run-auth
$ cd run-auth && rer dev

No npm? curl -fsSL https://runeditrun.com/install.sh | sh installs the same command.