← Back to projects

Identity & distributed systems

OpenAuth

An identity server with tenant-aware sessions, replay protection, and durable event delivery.

Go · OIDC / OAuth 2.0 · PostgreSQL · Redis

Status: Technical validation

Engineering problem

Keep identity, token lifecycles, and asynchronous delivery consistent across concurrent requests and dependency failures.

Approach & architecture

  • Authorization Code with PKCE S256, discovery/JWKS, MFA, and tenant-aware sessions.
  • Refresh-token rotation and DPoP-bound tokens, with replay protection backed by PostgreSQL and Redis.
  • Separate API and worker processes; transactional outbox with idempotent, retry-safe delivery.

Outcomes & scope

  • Implemented identity and token flows with concurrency-tested delivery.
  • Under technical validation; no production-readiness or OpenID certification claim.