Self-hosted identity, standard OIDC

One login for every service you run. Your users credentials stay on your hardware.

You is a self-hosted identity and access management service: login UI, 2FA, magic links, passkeys, per-app roles, a management console, and an audit trail. Free and open source under MIT. Apps integrate over standard OIDC, or directly over Erlang distribution when they are BEAM apps you trust.

Why I built this

Free, self-hosted, good enough.

I needed a free, self-hosted identity service for my projects. One login, one user store, no monthly bill. And I wanted it to run as a BEAM node I could just drop into an Erlang/OTP cluster, so trusted apps talk through TCP message passing instead of all the HTTP bureaucracy. You is that service, built for my own use and open for anyone who wants the same.

The console

Identity you can actually operate.

You ships with a management console out of the box. Register apps, manage users and orgs, watch the audit trail live, and tune the instance. No YAML, no restarts.

you · /console

Apps & client secrets

Register consumer apps, issue one-time client secrets, rotate them anytime.

Users & roles

Promote admins, force a user logged out everywhere, anonymize on request.

Organizations

Group users into orgs with per-member roles, ready for team billing later.

Live audit trail

Every login, grant and admin action lands in a readable stream you can filter and forward to a webhook.

Instance settings

Node name, distribution cookie, SCIM token, token lifetimes. No restarts, no config files.

Sessions & tokens

Short-lived JWTs with per-token revocation by JTI. Kill one session without touching the rest.

The account area

Every user gets an account page at /users/dashboard.

It lists the apps they granted access to, their active sessions, their passkeys, their two-factor settings and any external accounts they linked. It comes with the instance, so your app does not have to render any of it.

you · /users/dashboard

Granted apps

One card per app the user consented to, linking into it. Removing a card revokes the consent.

Active sessions

Each session with the time it signed in. The user can revoke one or sign out everywhere else.

Two-factor

TOTP with recovery codes, or a code emailed at each password sign-in. The user turns both on and off.

Passkeys

Register and remove passkeys: fingerprint, face unlock or a security key.

Connected accounts

External providers linked to the account, each shown with its email, and unlinkable.

Data export

A JSON dump of the account, its consents and their scopes, at /users/settings/access_data.

Everything else

What ships besides those two screens.

Pink is what a person signing in gets. Blue is what your apps and scripts talk to.

Hardened login

Bcrypt hashing and rate limiting are on from the first request. Nothing to enable.

Two-factor and passkeys

TOTP with recovery codes, emailed codes, or a passkey instead of a password. Wired into the login flow, not bolted on after.

Magic links

Email a one-time sign-in link, without taking passwords away from the users who prefer them.

Organizations

Group users into orgs with per-member roles, separate from their per-app roles.

Standard OIDC

Authorization code with PKCE, discovery, JWKS, userinfo, introspection and revocation. Any OIDC client library works.

Tokens verified locally

Short-lived JWTs signed with Ed25519. Apps check them against the JWKS with no round trip, and single tokens are still revocable by JTI.

Signed webhooks

Logins, token exchanges, consent changes and admin actions posted to your endpoint, signed and retried three times.

SCIM 2.0 provisioning

Create, update and deprovision users from an upstream directory or a script, at /scim/v2 with a bearer token.

Management REST API

Automate users, apps, roles and audit reads over /api/v1 instead of clicking.

In-cluster RPC

BEAM apps you trust skip HTTP entirely and call You.IAM.Server through You.SDK over Erlang distribution.

Per-app login pages

Each app's name, logo and brand color on the login its users see. The default stays plain.

Audit trail

Every login, grant and admin action in one readable stream you can filter and forward.

When not to use You

Sometimes hosted auth is the right call.

You keeps identity on hardware you control, and any app talks to it over standard OIDC. If you would rather not run identity yourself at all, a hosted provider is less work.

You want zero-ops managed auth

If running identity yourself isn't worth it, a hosted provider is a better fit.

Use Auth0 or Clerk

You want identity inside your own infrastructure

Credentials and the login page stay on hardware you control, and any app speaks to it over standard OIDC. If those apps run on the BEAM, they can skip HTTP and talk over Erlang distribution instead.

Use You
07 · Get started

Running in five minutes.

Free and open source under MIT. Build from source or pull the image, bootstrap the first admin, then point an app at it.

01

Pull and run

Pre-built image on GitHub Container Registry. One container with SQLite inside.

docker pull ghcr.io/mandax/you:latest
docker run -d \
  -e DATABASE_PATH=/data/you/prod.db \
  -e SECRET_KEY_BASE=$(openssl rand -base64 48) \
  -e PHX_HOST=you.example.com \
  -v you-data:/data/you \
  -p 4000:4000 \
  ghcr.io/mandax/you:latest
02

Bootstrap the first admin

Creates the initial admin user; runs migrations first if needed.

docker exec <container> bin/you eval \
  'You.Release.bootstrap_admin("[email protected]", "your-password")'
03

Integrate an app

Register the app in the console, redirect its users to You, verify tokens locally against the JWKS. Any OIDC client library works.