ZenoAuth - The Logic of Access | Enterprise IAM Platform

Built on the Philosophy of Control

You can't control the threats. You can control the gate. ZenoAuth gives you logical control over what matters most: who comes in and what they can access.

🔐

Complete OAuth 2.0 & OIDC

Full OAuth 2.0 and OpenID Connect implementation with all standard endpoints. Authorization code flow, token introspection, revocation, and JWKS discovery.

Authorization code with PKCE (RFC 7636)
Pushed Authorization Requests - PAR (RFC 9126)
Dynamic Client Registration - DCR (RFC 7591)
Rich Authorization Requests - RAR (RFC 9396)
Token introspection (RFC 7662) & revocation (RFC 7009)
OpenID Connect discovery & UserInfo
Ed25519 JWT signing with key rotation

🔑

Multi-Factor Authentication

Comprehensive MFA with multiple methods: TOTP, WebAuthn/Passkeys, SMS/Email OTP, and Magic Links. Choose the right security for your users.

WebAuthn / Passkeys (FIDO2)
TOTP with backup codes
SMS & Email OTP verification
Magic Link passwordless login

🌐

External SSO Providers

Connect external identity providers via OIDC or OAuth 2.0. Support for all major providers with automatic provisioning and account linking.

Google, Microsoft, GitHub, Okta
Any OIDC/OAuth 2.0 provider
Auto-provision users on first login
Account linking support

👥

SCIM v2 Provisioning

Enterprise user and group provisioning via SCIM 2.0 protocol with nested groups support. Both inbound (receive from Okta, Azure AD) and outbound (push to Slack, ServiceNow, etc.).

Nested groups with transitive membership
Inbound & outbound bidirectional sync
Event-driven & scheduled sync
RFC 7643/7644 compliant

🏢

RBAC & Access Control

Fine-grained Role-Based Access Control with hierarchical roles, custom permissions, and group-based policy enforcement.

Hierarchical roles with inheritance
Fine-grained permissions (resource:action)
User & group role assignments
Organization-scoped isolation

🔄

Signing Key Management

Enterprise-grade JWT key lifecycle management. Create, rotate, and revoke Ed25519 signing keys with full audit trail and JWKS distribution.

Ed25519 key generation
Key rotation with grace periods
JWKS endpoint for verification
Emergency key revocation

🖥️

Modern Admin Interface

Professional Next.js 15 admin dashboard with React 19. User management, client configuration, analytics, and comprehensive audit logging.

Users, clients, groups, scopes
SSO provider configuration
Token & key management
Real-time analytics & audit logs

⚡

Lean & Lightning Fast

A single 11 MB binary. PostgreSQL is your only dependency. No Redis, no message queues. 27x smaller than Keycloak. Start in milliseconds, not minutes.

11 MB binary (vs 300+ MB)
~50 MB memory footprint
Zero GC pauses (Rust)
Built-in caching & sessions

⚖️

GDPR Compliance & Data Governance

Complete data privacy compliance with user deletion, data export, and configurable retention policies. Right to be forgotten with 30-day grace period.

User deletion requests with grace period
Personal data export (JSON/CSV)
Automated retention policy management
Privacy policy versioning & tracking

🔗

LDAP/Active Directory Sync

Enterprise user and group synchronization with Active Directory and OpenLDAP. Full-sync and incremental sync support with custom attribute mapping.

LDAP/AD user and group import
Custom attribute mapping rules
Incremental sync for efficiency
Bidirectional sync support

📱

Session & Device Management

Complete session lifecycle management with per-device tracking and trusted device support. View login history, revoke sessions, and remember trusted devices.

Detailed session history with IP & location
Trusted device management
Device fingerprinting for security
Granular session revocation

🚨

Emergency Access & Break Glass

Secure emergency access codes for critical situations. MFA-verified, session-restricted, and fully audited break glass authentication.

Emergency access code generation
MFA verification required
IP and time-limited sessions
Complete audit trail

🏷️

Custom Domains & Branding

White-label your authentication with custom domains. Replace zenoauth.io with your own domain for seamless brand integration.

Custom domain configuration
CNAME verification
JWT issuer auto-update
Branded login URLs

⏱️

Advanced Rate Limiting

Organization-wide rate limiting with per-application overrides. Fine-grained control over API throttling to prevent abuse and ensure fair resource allocation.

Organization-level rate limits
Per-application overrides
Configurable throttle rates
Flexible bucket strategies

👥

MFA Group Enforcement

Require multi-factor authentication at the group level. Enforce organization-wide or group-specific MFA policies to ensure all users meet security standards.

Group-level MFA requirements
Automatic enforcement at login
User MFA status tracking
Compliance reporting

Deploy Your Way

Choose between our managed cloud or deploy on your own infrastructure. Same powerful platform, your choice of control.

☁️

Cloud Hosted

Get started in minutes. We handle the infrastructure, you focus on your application. 99.9% uptime SLA included.

From €20 /month

(Planned for 2026)

Learn More

🏢

Self-Hosted

Maximum control. Deploy on your infrastructure with unlimited users and applications. Your data never leaves your servers.

€2000 /year

Learn More

The Gateway Architecture

Inspired by the ancient port of Citium—Zeno's home—ZenoAuth serves as your digital gateway, uniting diverse identities through a single, logical point of control.

ZenoAuth Architecture Diagram - Modern Glass Morphism Design

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   Web Admin     │    │   User Portal   │    │   Your Apps     │
│   (Next.js)     │    │   (Next.js)     │    │                 │
└─────────────────┘    └─────────────────┘    └─────────────────┘
         │                       │                       │
         └───────────────────────┼───────────────────────┘
                                 │
              ┌─────────────────────────────────────┐
              │           ZenoAuth API              │
              │        (Rust + Axum)               │
              │                                     │
              │  ◦ OAuth 2.0 & OIDC Flows          │
              │  ◦ User & Session Management        │
              │  ◦ Token Validation & Refresh       │
              │  ◦ Rate Limiting & Security         │
              │  ◦ Admin & Analytics APIs           │
              └─────────────────────────────────────┘
                                 │
              ┌─────────────────────────────────────┐
              │        ┌─────────────────┐          │
              │        │   PostgreSQL    │          │
              │        │                 │          │
              │        │ • Users & Apps  │          │
              │        │ • Sessions      │          │
              │        │ • Audit Logs    │          │
              │        │ • Built-in Cache│          │
              │        └─────────────────┘          │
              └─────────────────────────────────────┘

The Logic: One database, one service, complete control.

The Logic: One database, one service, complete control.

11 MB

Single Binary

~50 MB

Memory Footprint

157+

API Endpoints

SCIM 2.0

Inbound & Outbound

Enterprise-Ready Capabilities

Full-featured identity management with SCIM provisioning, comprehensive APIs, and a modern admin interface built for enterprise scale.

👥

SCIM v2 Provisioning

Complete bidirectional SCIM 2.0 provisioning with nested groups support. Inbound: receive users and group hierarchies from Okta, Azure AD, Google Workspace. Outbound: push users and nested group structures to Slack, ServiceNow, and other SCIM-compatible systems. Groups can contain other groups with automatic transitive membership resolution.

SCIM User Creation

# Create user via SCIM
POST /scim/v2/Users
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "john.doe@company.com",
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  }
}
                        

✓ Inbound & Outbound sync
✓ Event-driven + scheduled
✓ Custom attribute mapping
✓ RFC 7644 compliant

🔐

OAuth 2.0 Authorization

Complete OAuth 2.0 implementation with OpenID Connect and Pushed Authorization Requests (PAR). Authorization code flow with PKCE, token management, introspection, and JWKS for secure token validation.

Secure PAR Flow (RFC 9126)

# Step 1: Push authorization request
POST /oauth/par
Authorization: Basic base64(client_id:secret)
{
  "response_type": "code",
  "redirect_uri": "https://app.com/callback",
  "scope": "openid profile"
}

# Response: Short-lived request_uri
{
  "request_uri": "urn:ietf:params:oauth:request_uri:abc123",
  "expires_in": 60
}
                        

✓ PAR for enhanced security (RFC 9126)
✓ Token introspection & revocation
✓ OIDC discovery & UserInfo
✓ JWKS key rotation

Complete API Surface

/auth/*

/oauth/*

Authorization, Token
Introspect, Revoke

/scim/v2/*

Users, Groups
Provisioning

/admin/*

Management
Analytics, Audit

Well-documented REST APIs for every operation. Built with Axum for high performance and comprehensive error handling.

Why Security Professionals Choose ZenoAuth

Compare the logical choice against complex and expensive alternatives.

Feature	ZenoAuth	Keycloak	Auth0	Okta
Binary Size	✅ 11 MB	❌ 300+ MB	N/A (SaaS)	N/A (SaaS)
Zero Dependencies	✅ PostgreSQL only	❌ Multi-service	N/A (SaaS)	N/A (SaaS)
Multi-Factor Auth (MFA)	✅ TOTP, WebAuthn, OTP	✅ Included	✅ Included	✅ Included
Passkeys / WebAuthn	✅ FIDO2 support	✅ Included	✅ Included	✅ Included
External SSO Providers	✅ OIDC/OAuth2	✅ Included	✅ Included	✅ Included
SCIM v2 Provisioning	✅ Inbound + Outbound	✅ Plugin	✅ Enterprise	✅ Extra cost
Key Rotation	✅ Ed25519 + JWKS	✅ Included	✅ Included	✅ Included
Self-Hosted Option	✅ €2000/year	✅ Free (complex)	❌ No	❌ No
Modern Admin UI	✅ Next.js 15	❌ Legacy	✅ Good	✅ Good
Memory Safe	✅ Rust	❌ Java	N/A	N/A
Memory Footprint	✅ ~50MB	❌ ~500MB+	N/A	N/A
Cost (1,000 users)	✅ €95/mo	Free (ops cost)	~$500-1,500/mo	~$2,000+/mo
GDPR Compliance	✅ Data export, deletion, retention	✅ Limited	✅ Included	✅ Included
LDAP/Active Directory	✅ Full sync + mapping	✅ Plugin	✅ Included	✅ Included
Session Management	✅ History + trusted devices	✅ Basic	✅ Good	✅ Included
Emergency Access (Break Glass)	✅ MFA-verified codes	❌ No	✅ Included	✅ Included
Custom Domains & Branding	✅ White-label URLs	❌ Complex	✅ Included	✅ Included
Advanced Rate Limiting	✅ Per-app overrides	❌ Basic	✅ Included	✅ Included
MFA Group Enforcement	✅ Group-level policies	❌ No	✅ Included	✅ Included
Fine-Grained RBAC	✅ Hierarchical roles	✅ Basic	✅ Included	✅ Included
Magic Link Auth	✅ Passwordless	❌ No	✅ Included	✅ Included

The Logical Choice: Enterprise features at a fraction of the cost.

View Full Pricing

The Logic of Access

Built on the Philosophy of Control

Complete OAuth 2.0 & OIDC

Multi-Factor Authentication

External SSO Providers

SCIM v2 Provisioning

RBAC & Access Control

Signing Key Management

Modern Admin Interface

Lean & Lightning Fast

GDPR Compliance & Data Governance

LDAP/Active Directory Sync

Session & Device Management

Emergency Access & Break Glass

Custom Domains & Branding

Advanced Rate Limiting

MFA Group Enforcement

Deploy Your Way

Cloud Hosted

Self-Hosted

The Gateway Architecture

Enterprise-Ready Capabilities

SCIM v2 Provisioning

OAuth 2.0 Authorization

Complete API Surface

Why Security Professionals Choose ZenoAuth

Security Built on Logic, Not Fear

Modern Cryptography

Zero-Trust Architecture

Complete Audit Trail

Compliance Ready

Control What Matters