oauth4webapi

Similar to Firebase it's multi-strategy based. You can use a combo of email/password or OAuth/OIDC (internally using https://github.com/panva/oauth4webapi) – currently there are 2 pre-configured (Google, Github), but it's easy to extend, so requests are welcome. On the Authorization side, you can create roles and attach permissions to it. Those roles then get attached to users. Claims are transported via JWT, you can configure its lifetime, secret and hashing. Currently it's stateless, meaning the token is not checked in a session store. But if there is demand, I'd prioritize adding this. I'm mainly exactly looking for feedback to prioritize next additions. Hope this helps.

> Last but not least, cost. I’ll just come out and say it: IMHO, what most vendors charge for being IdP is outrageous. Charging by MAU in an IdP? Really? We all know that the marginal cost for me to have a user in your system is essentially 0. You really gonna charge me 10 cents a month for a row in your database? I've been looking into adding OAuth2/OIDC IdP integrations to an app I'm making. The pricing for most auth-as-a-service is indeed outrageous, and I don't need (or want) JWT. oauth4webapi [1] fits the bill here, is free and certified. Took less than an afternoon to have sign in with Google and another IdP. There's obviously more work to be done, but it's not rocket science. Don't know if there's an equivalent for SAML. But I've certainly considered going into the auth SaaS business a few times. Seems like there's good money to be

For those looking for production-level OAuth libs, the best implementation for all JS runtimes is https://github.com/panva/oauth4webapi Certified, thoroughly tested, zero deps, fully typed, secure defaults, works in Node/Deno/Bun/Edge, supports PKCE/dPoP/etc.