Skip to content

Your identity data stays in Europe

EuroAuth is a managed, EU-hosted OAuth 2.1 and OpenID Connect provider. Every organization gets its own issuer, live within seconds of creating it.

Create an accountSign in

No credit card, because there is nothing to bill yet: EuroAuth is pre-launch and free while it is. You keep every client and user you register.

What you get

Your own issuer

Create an organization and it is reachable at its own hostname immediately. No DNS record to add, no hostname to register with us, no support ticket.

PKCE is required

Not optional, and not a setting you can turn off. An authorization request without an S256 challenge is rejected.

Ed25519 signatures

ID tokens are signed with Ed25519 and published as RFC 8037 OKP keys. There is no RSA anywhere in the dependency tree.

Your own issuer, not a path on ours

This is the document every client library fetches first. Read down it: the hostname in each endpoint is yours, and so is the iss claim in every token minted against it.

A new issuer resolves within thirty seconds. Until it does, its hostname answers 404 rather than serving this document under the wrong issuer — a client that cached the wrong one would fail signature checks long after we had fixed the mistake.

{
  "issuer": "https://acme-inc.id.euroauth.com",
  "authorization_endpoint": "https://acme-inc.id.euroauth.com/authorize",
  "token_endpoint": "https://acme-inc.id.euroauth.com/token",
  "userinfo_endpoint": "https://acme-inc.id.euroauth.com/userinfo",
  "introspection_endpoint": "https://acme-inc.id.euroauth.com/introspect",
  "revocation_endpoint": "https://acme-inc.id.euroauth.com/revoke",
  "jwks_uri": "https://acme-inc.id.euroauth.com/jwks",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["EdDSA"],
  "scopes_supported": ["openid", "profile", "email"],
  "token_endpoint_auth_methods_supported": ["none"]
}
GET /.well-known/openid-configuration

Three requests from here to a verified token

  1. Send them to your issuer

    PKCE is required, not optional — a request without a challenge is rejected.

    GET https://acme-inc.id.euroauth.com/authorize
  ?response_type=code
  &client_id=web-app
  &redirect_uri=https://app.example.com/callback
  &scope=openid%20email
  &state=OPAQUE_STATE
  &code_challenge=BASE64URL(SHA256(verifier))
  &code_challenge_method=S256

  2. Exchange the code

    The code is single-use: redemption deletes it in the same statement that returns it, so a replay finds nothing.

    POST https://acme-inc.id.euroauth.com/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=RETURNED_CODE
&redirect_uri=https://app.example.com/callback
&client_id=web-app
&code_verifier=ORIGINAL_VERIFIER

  3. Verify the ID token

    Signed with Ed25519 and published as an RFC 8037 OKP key. There is no RSA in the dependency tree.

    GET https://acme-inc.id.euroauth.com/jwks

{
  "keys": [
    {
      "kty": "OKP",
      "use": "sig",
      "alg": "EdDSA",
      "crv": "Ed25519",
      "kid": "KEY_ID",
      "x": "BASE64URL_PUBLIC_KEY"
    }
  ]
}

Register a client in the next ten minutes

You will need an organization, one client, and a redirect URI. Everything above is what you get for it.

Create an accountRead the API reference

There is no wall of customer logos on this page, because there are no customers yet. EuroAuth is pre-launch: the capabilities marked live above run, the rest are scheduled, and nothing here is a number we made up.