heautou

What it does

Self-hosted apps each want their own login. Heautou lets them all use one sign-in, without running Keycloak or Authentik: one container, one folder of data, and a web page for adding the apps and the people who use them.

• One sign-in for every app

  A standard OIDC provider for the authorization code flow, with client secrets or PKCE; apps can pair themselves from a setup link.

• Two-factor and passkeys

  Users add an authenticator app or passkeys on their account page, and apps can see from the token how they signed in.

• No database server needed

  Everything is kept in a database built into heautou, or in your own Postgres if you have one. Secrets are sealed under a key you choose, and every sign-in and change goes in an audit log.

Get started

docker run -d -p 3000:3000 -v heautou-data:/data \
  -e ISSUER_URL=http://localhost:3000/oidc \
  ghcr.io/cubicecho/heautou:latest

# then open http://localhost:3000 and create the first admin

Full documentation lives in the project README: https://github.com/cubicecho/heautou