Features
Overview
A tour of what eetr-auth does across OAuth/OIDC, clients, authentication, tokens, and administration.
eetr-auth is a complete authorization server, not just a token endpoint. This section documents
the feature set in depth.
OAuth 2.1 & grants
Authorization Code + PKCE, Client Credentials, and Refresh Token with rotation.
Clients & registration
Confidential and public clients, RFC 7591 Dynamic Client Registration, and scopes.
Authentication
Passwords (Argon2id), password policies, passkeys, and multi-factor auth.
Tokens
Access/refresh tokens, resource-indicator audience binding, introspection, and cleanup.
Administration
The admin dashboard, user & environment management, and the admin API.
OIDC compliance
Supported specs, discovery metadata, claims, and conformance notes.
Security summary
| Feature | Detail |
|---|---|
| Password hashing | Argon2id via isolated WASM Worker |
| Password policies | Per-environment complexity rules + max password age enforced at login |
| Token signing | RS256 asymmetric JWT |
| Token MAC | HMAC-SHA256 for internal request signing |
| PKCE | S256 mandatory for the Authorization Code flow |
| Session encryption | AUTH_SECRET via NextAuth.js |
| Service isolation | argon-hasher rejects non-service-binding calls (403) |
| Redirect URI validation | Exact match required |