OAuth2 and OpenID Connect authorization flows
OAuth2 · OIDC · Passkeys · Multi-tenancy
Give every tenant its own issuer URL.
OpenIssuer is a multi-tenant OAuth2 and OpenID Connect platform for apps that need tenant-scoped issuers, OAuth clients, users, roles, and admin workflows without building identity infrastructure from scratch.
free.openissuer.comIssuer
→
OIDC ClientRedirect + PKCE
→
OrgAdminScoped access
{ "tenant_id": "free.openissuer.com", "scope": ["openid", "profile"] }Capabilities
Built around real authorization workflows.
Host-based tenant issuer resolution
Business issuer and OAuth client management
Organization and subdomain admin scopes
User, role, organization, and default-tenant management
NextAuth demo clients for real tenant sign-in
For small businesses
Launch tenant-specific sign-in without rebuilding OAuth.
Each tenant can use its own issuer host, admin portal, OAuth clients, and organization membership while OpenIssuer keeps the platform services shared.
- A business signs up and gets a tenant issuer host.
- Admins create OAuth clients and manage users.
- Applications redirect users to the matching issuer.
- OpenIssuer returns tenant-scoped tokens and claims.
Platform
Designed as a working authorization system.
The project uses Spring Boot, Spring Security, PostgreSQL, Kubernetes Gateway API, and tenant-aware service routing. The public demo signs in through live NextAuth clients for free and business tenants.