Identity, access & licensing — solved on day one.
CoreOps Auth is a multi-tenant authentication and licence server. It runs your organisations, tenants and users, decides what each of them can reach, and licenses your applications to the tenants that use them — with a full audit trail behind every action.
Organisations & tenants · Licensed applications · TOTP MFA · Row-Level Security · Full audit trail — hardened by default.
Identity
a.morgan
Policy
{
"role": "admin",
"allow": ["read","write"],
"mfa": true
}Resources
- /api/users
- /api/settings
- /api/backups
Roles
Audit logs
Ways to authenticate
Backup & restore
CoreOps Base Application
One server for every organisation you run.
CoreOps Auth gives each organisation its own tenants, administrators and users, keeps their data apart, and tells your applications who may use them. It's built on Next.js and PostgreSQL, with every decision documented — ready to run, and yours to extend.
How it works
- 1
Set up organisations & tenants
Create an organisation for each customer or business unit, and the tenants inside it. Each starts with its own roles and policies.
- 2
Invite your people
Invite users by email or CSV, give them access to the right tenants, and let them secure their own accounts with MFA.
- 3
License your applications
Register your applications, license them to tenants, and let them ask the API who may sign in and with which role.
Everything identity, access and licensing needs
Multi-tenancy, access control, licensing and operations — production-ready, and yours to extend.
Organisations & Tenants
Run any number of organisations, each with its own tenants. One login can belong to several organisations and tenants and switch between them. Tenant data is isolated row by row, with PostgreSQL Row-Level Security enforcing it on the API.
Access by Account Type
Owner, Global Administrator, Organisation Administrator and Standard User — each sees exactly the pages its role allows, and everything else is denied by default.
Licensed Applications
Register your own applications, issue them tokens, and license them to tenants with seats and expiry. Applications ask the API which tenants they serve, who their users are and what role each user holds.
People, Start to Finish
Invite by email, assign access per organisation and tenant, archive and restore, and protect the accounts that must never be locked out — with self-service profiles, sign-in history and personal access tokens.
Complete Audit Trail
Six logs — sign-ins, system events, email, API, policy decisions and public traffic — each entry tagged with its organisation and tenant, and every API request with the user, token or application that made it.
MFA, Made Easy
Standard TOTP works with any authenticator app, with backup codes to prevent lockout. Enforce it platform-wide with a grace period.
RBAC for the API
Roles, policies, resources and validator rules decide what every API request may do — edited visually or as JSON, with each decision recorded.
Operations Built In
One-click backup and restore, per-tenant export and import, webhooks, transactional email and a Prometheus metrics endpoint.
Every request, checked before it lands
Pages open by account type; API calls are authorised by RBAC policy and confined to their tenant by the database itself. Every decision is logged.
Authenticate
Session, PAT or app token
Scope
Organisation & tenant
Authorise
Account type or RBAC policy
Enterprise-grade security, out of the box
Security headers, rate limiting, account lockout and revocable sessions are configured for you and applied globally. No per-page setup, no forgotten defaults — protection is on the moment you deploy.
CSP & HSTS
Hardened headers, applied globally.
Rate limiting
Per-IP on every sensitive route.
Account lockout
Auto-locks after failed attempts.
Revocable sessions
Sign out any device, instantly.
The foundation beneath your whole toolkit
CoreOps Auth is the identity and licensing layer other products rely on. CoreOps-Forge — full project and ticket management for DevOps teams — is a licensed application: with its application token it checks each tenant's licence and the role of every user. Connect your own applications the same way.
CoreOps-Forge
Project management
Your internal tools
Built by your team
CoreOps Auth
Identity · Access · Licensing · API
Run every organisation on a foundation you can trust
Sign in to set up your organisations and tenants, invite your people and license your applications — with identity and security already handled.