Auris — identity, access, licensing

One login for every app. Yours to run.

Auris signs people into the ERP, the cloud, Comply and your own apps with a single session. Tenants, roles, permissions, machine clients, licence keys and a distributor network live in one console, under your brand.

How the login works Read the docs
The Auris console, Users page: thirteen demo users with role, verification state, status and creation date, with search and filters above the table. The Auris console, Users page: thirteen demo users with role, verification state, status and creation date, with search and filters above the table.

The console. A screenshot, not a mockup.

Four things you can check

Built on four rules.

The boundary
One tenant, one realm

Every tenant gets its own realm. Users, roles, sessions and keys never cross it. Organizations group customers inside a tenant without blurring the line.

Permissions
action:resource

Every permission is a readable slug. Roles are lists of slugs, apps publish their own catalogue, and the console checks roles against it.

Sessions
Revoked once, gone everywhere

Sessions live in a shared store. Revoke one in the console and every app refuses it on the next request.

The log
Append-only

The audit log rejects updates and deletes at the database level. Erasure under data-protection law is the one exception, and it is logged too.

Who can do what, in plain words.

Pick a role and see the permissions it carries. The slugs are the real ones the API checks.

Everything in the tenant, admin:all included. Every tenant has at least one.

All management permissions of the tenant: users, roles, security, licences, distribution. Without admin:all.

Read access: users, roles, members, security settings, audit log, and the products the tenant has.

A role you compose from the catalogue, any set of slugs. Roles are ordered, so nobody grants more than they hold. Here, an example support role.

action:resource OwnerAdminMemberTeam role
view:users granted granted granted granted
manage:users granted granted not granted not granted
view:roles granted granted granted not granted
manage:roles granted granted not granted not granted
view:members granted granted granted granted
manage:members granted granted not granted not granted
manage:sessions granted granted not granted granted
view:security granted granted granted not granted
manage:security granted granted not granted not granted
view:audit granted granted granted granted
export:audit granted granted not granted not granted
manage:license-keys granted granted not granted not granted
view:license-stats granted granted not granted not granted
read:distribution granted granted granted not granted
manage:distribution granted granted not granted not granted
admin:all granted not granted not granted not granted

Team roles and organization roles draw from the same catalogue. Apps publish their permissions to it; deprecated keys stay visible but stop being assignable.

Tenants, organizations, people.

The console is where the boundary gets drawn and the people get in.

Tenant
A realm of its own, created from the console in one step. Everything below belongs to exactly one tenant.
Organizations
Group B2B customers inside a tenant, each with its members, roles and invitations. Invitations expire, seven days by default.
Users
Create, block, import and export in bulk, or let SCIM 2.0 provision them from your directory. Impersonation exists and needs admin:all.
Groups
Nest them; members inherit the group's roles.
Federation
Connect an existing LDAP directory. People stay where they are and sign in through Auris.

A licence key, from policy to runtime.

Licensing is part of Auris, not a bolt-on. Follow one key.

Also

Automation
A payment webhook can issue a key on its own, under rules you write.
Audit
Every licensing event lands in the audit log.

Policy

Decide what a key can carry: format, features, seats, devices, expiry, usage metrics. Online, offline or hybrid validation.

Issue

Issue it to a user, an organization, a device, an email address or a whole tenant. For the ERP, pick the modules it unlocks. Attribute it to a distributor if one sold it.

Activate

A device activates with its fingerprint. Past the device limit the activation is refused; the same device coming back is just refreshed.

Validate

Your app validates online and gets features, seats, devices and expiry back. When it cannot, the SDK says why: expired, revoked, or no network.

Float

Floating seats: check out, heartbeat, check in. A lease lasts thirty minutes unless renewed; a cron sweeps the expired ones.

Suspend

Suspend, revoke or let it expire. The status flips on the next listing, and a signed revocation list carries the key id for offline clients.

From a grant to a paying customer.

Distributors sell your product lines. They get a grant, not the keys to your tenant.

  1. Grant

    Per product line you set the modules, the discount and how many customers. An empty module list means all of them.

  2. Issue

    The partner issues keys from their own portal. The key is shown in clear once; from then on it is masked.

  3. Attribute

    The customer is attributed to that distributor automatically. A customer belongs to one channel.

  4. Steer

    The partner suspends or reactivates their keys from the portal. Suspending a distributor never cuts a customer's service.

Try to issue a key

Flip the conditions. The rule that stops the request is the one the API returns.

201 · Issued AURIS-3F8Q-****-****-Z1KD

The key is returned in clear, once. The customer is attributed to the distributor.

403 · DISTRIBUTOR_NOT_ACTIVE

Suspended or terminated distributors issue nothing.

403 · LINE_NOT_GRANTED

No grant for this line.

403 · MODULES_NOT_GRANTED

A module outside the grant was requested.

409 · CUSTOMER_ATTRIBUTED_ELSEWHERE

Another distributor already has this customer.

403 · MAX_CUSTOMERS_REACHED

The grant's customer quota is full.

The other rules

DISTRIBUTOR_NOT_ACTIVE
Suspended or terminated distributors issue nothing.
LINE_NOT_GRANTED
No grant for this line.
MODULES_NOT_GRANTED
A module outside the grant was requested.
CUSTOMER_ATTRIBUTED_ELSEWHERE
Another distributor already has this customer.
MAX_CUSTOMERS_REACHED
The grant's customer quota is full.
CUSTOMER_NOT_ALLOWED
Never the platform, never the partner's own tenant.
TENANT_NOT_FOUND
The customer tenant does not exist.

Your brand on the front door.

The hosted pages are yours to style. The console previews each of them live while you edit.

Branding in the Auris console: the theme editor's colour panel on the left, on the right the live preview of the passkey page. Branding in the Auris console: the theme editor's colour panel on the left, on the right the live preview of the passkey page.
Theme editor and live preview.
Theme
Logo, colours, background, footer text. Presets you save and reuse. A visual builder, or plain HTML and CSS when you want full control.
Pages
Login, sign-up, password reset, second factor, passkeys, consent, account locked, magic link: one theme, seventeen pages.
Email
Thirteen email types with a live preview and your own SMTP server, in five languages.
Domain
Serve the pages under your own domain, verified with a DNS record.

Hardened where it matters.

Every login goes through the same chain of checks. You tune them; the log keeps the receipts.

Sessions and tokens
Idle and maximum lifetimes, remember-me, per-client overrides. Token lifespans down to the minute.
Attack protection
Lockout after too many failures, per-IP throttling, allow and block lists, bot checks on login, sign-up and reset.
Suspicious logins
New device or location: the attempt is scored, recorded, and can require a second step.
Audit and export
An append-only log of every admin action, streamed to your own log destination if you want. Signed webhooks for everything else.
Token and claims settings in the Auris console: access token, implicit flow and authorization code lifespans. Token and claims settings in the Auris console: access token, implicit flow and authorization code lifespans.
Token lifespans.
Session policy in the Auris console: SSO idle timeout and maximum lifespan, remember-me, per-client overrides, offline session. Session policy in the Auris console: SSO idle timeout and maximum lifespan, remember-me, per-client overrides, offline session.
Session policy.

Standards, not dialects.

Twelve protocols, each measured in the API. Your existing clients already speak them.

  • OAuth 2.0 RFC 6749
  • OpenID Connect OIDC Core 1.0
  • PKCE · S256 RFC 7636
  • JWKS RFC 7517
  • client_credentials RFC 6749 §4.4
  • Refresh rotation RFC 9700 · Security BCP
  • Device Flow RFC 8628
  • Token Exchange RFC 8693
  • DPoP RFC 9449
  • CIBA OpenID CIBA Core 1.0
  • WebAuthn W3C Level 2
  • SCIM 2.0 RFC 7643 · 7644

Discovery at /.well-known/openid-configuration, keys at /.well-known/jwks.json.

Machines log in too.

Every integration is an application with a client id, scopes and a token lifetime you set.

Machine clients
client_credentials tokens bound to the tenant, a scope catalogue, revocation per token.
Personal API keys
Each person can mint keys limited to self-service scopes, and rotate them.
Webhooks and actions
Signed webhooks on events. Declarative rules that run before or after login, registration and token issuance.
SDKs and tools
JavaScript, React and Next.js packages on npm. PHP, Python, Go and Rust clients. Licensing clients for C# and Swift. A CLI and an MCP server.
middleware.ts
$ npm install @auris/nextjs
import { aurisMiddleware } from '@auris/nextjs/middleware'

export default aurisMiddleware({
  domain: process.env.AURIS_DOMAIN!,
  clientId: process.env.AURIS_CLIENT_ID!,
  tenant: 'acme',
  protectedPaths: ['/dashboard', '/settings'],
  publicPaths: ['/', '/login', '/callback'],
  loginUrl: '/login',
})
The Next.js middleware, as exported today.

Comply runs on it.

Comply, our compliance workspace, signs in through Auris and checks every permission against it: frameworks and controls, evidence, audits, policies, risks, incidents, privacy registers and PDF reports, inside the same tenant boundary.

Discover Comply

Put Auris in front of your apps.

Start with the docs, or talk to us about tenants, licensing and your distributor network.

Talk to us Documentation