masks

Every tenant has its own keys

Each tenant signs its tokens with its own key. A token from one tenant will not work on another, because the other has no key to check it with.

A server, not a library

You run masks next to your app, not inside it. It handles its own sign-in pages, sessions and upgrades, and your app talks to it over standard OpenID Connect.

Apps can sign themselves up

An app can register itself and get credentials without you setting anything up first. That is how an AI connector adds itself, and it has worked since the first release.

Tokens only work where they belong

Every token names the API it was issued for. Present it to a different API and it is rejected, so one leaked token does not open everything.

Run itUp and running locally in about a minute.

The three piecesWhat each part does, and which ones you need.

TenancyHow masks identifies tenants, and what your app stores.

TokensWhat is inside a token, and how audiences work.

Sign an SPA inTwo ways to do it, and how to choose.

ConformanceTested against the OpenID Foundation's own suite.