You is a self-hosted identity and access management service: login UI, 2FA, magic links, passkeys, per-app roles, a management console, and an audit trail. Free and open source under MIT. Apps integrate over standard OIDC, or directly over Erlang distribution when they are BEAM apps you trust.
I needed a free, self-hosted identity service for my projects. One login, one user store, no monthly bill. And I wanted it to run as a BEAM node I could just drop into an Erlang/OTP cluster, so trusted apps talk through TCP message passing instead of all the HTTP bureaucracy. You is that service, built for my own use and open for anyone who wants the same.
You ships with a management console out of the box. Register apps, manage users and orgs, watch the audit trail live, and tune the instance. No YAML, no restarts.
Register consumer apps, issue one-time client secrets, rotate them anytime.
Promote admins, force a user logged out everywhere, anonymize on request.
Group users into orgs with per-member roles, ready for team billing later.
Every login, grant and admin action lands in a readable stream you can filter and forward to a webhook.
Node name, distribution cookie, SCIM token, token lifetimes. No restarts, no config files.
Short-lived JWTs with per-token revocation by JTI. Kill one session without touching the rest.
It lists the apps they granted access to, their active sessions, their passkeys, their two-factor settings and any external accounts they linked. It comes with the instance, so your app does not have to render any of it.
One card per app the user consented to, linking into it. Removing a card revokes the consent.
Each session with the time it signed in. The user can revoke one or sign out everywhere else.
TOTP with recovery codes, or a code emailed at each password sign-in. The user turns both on and off.
Register and remove passkeys: fingerprint, face unlock or a security key.
External providers linked to the account, each shown with its email, and unlinkable.
A JSON dump of the account, its consents and their scopes, at /users/settings/access_data.
Pink is what a person signing in gets. Blue is what your apps and scripts talk to.
Bcrypt hashing and rate limiting are on from the first request. Nothing to enable.
TOTP with recovery codes, emailed codes, or a passkey instead of a password. Wired into the login flow, not bolted on after.
Email a one-time sign-in link, without taking passwords away from the users who prefer them.
Group users into orgs with per-member roles, separate from their per-app roles.
Authorization code with PKCE, discovery, JWKS, userinfo, introspection and revocation. Any OIDC client library works.
Short-lived JWTs signed with Ed25519. Apps check them against the JWKS with no round trip, and single tokens are still revocable by JTI.
Logins, token exchanges, consent changes and admin actions posted to your endpoint, signed and retried three times.
Create, update and deprovision users from an upstream directory or a script, at /scim/v2 with a bearer token.
Automate users, apps, roles and audit reads over /api/v1 instead of clicking.
BEAM apps you trust skip HTTP entirely and call You.IAM.Server through You.SDK over Erlang distribution.
Each app's name, logo and brand color on the login its users see. The default stays plain.
Every login, grant and admin action in one readable stream you can filter and forward.
You keeps identity on hardware you control, and any app talks to it over standard OIDC. If you would rather not run identity yourself at all, a hosted provider is less work.
If running identity yourself isn't worth it, a hosted provider is a better fit.
Credentials and the login page stay on hardware you control, and any app speaks to it over standard OIDC. If those apps run on the BEAM, they can skip HTTP and talk over Erlang distribution instead.
Free and open source under MIT. Build from source or pull the image, bootstrap the first admin, then point an app at it.
Pre-built image on GitHub Container Registry. One container with SQLite inside.
docker pull ghcr.io/mandax/you:latest docker run -d \ -e DATABASE_PATH=/data/you/prod.db \ -e SECRET_KEY_BASE=$(openssl rand -base64 48) \ -e PHX_HOST=you.example.com \ -v you-data:/data/you \ -p 4000:4000 \ ghcr.io/mandax/you:latest
Creates the initial admin user; runs migrations first if needed.
docker exec <container> bin/you eval \
'You.Release.bootstrap_admin("[email protected]", "your-password")'
Register the app in the console, redirect its users to You, verify tokens locally against the JWKS. Any OIDC client library works.