Conformance-tested OIDC/OAuth2
Verified with the official OpenID Foundation conformance suite (release v5.2.4): the Config OP, Basic OP, and Form Post OP plans pass with 0 failures and 0 warnings. Advanced OAuth 2.1 capabilities included: PAR, JAR/JARM, RAR, DPoP, CIBA, token exchange, dynamic client registration.
Keycloak-compatible
The realm model, role claims (realm_access / resource_access), the Admin
REST API shape, adapter-config downloads, and kc_idp_hint behave the way your
existing Keycloak integrations expect. Every deliberate difference is
documented in tests/KEYCLOAK_DIFFS.md.
Fast and small
Faster than Keycloak 26.7 in every measured k6 scenario — up to 7.8× the
throughput, ~6× less memory, and an 8.7× smaller image. One self-contained
Rust binary; #![forbid(unsafe_code)] across the whole workspace.
Scales horizontally
Shared state lives in PostgreSQL + Redis, and storage-backed signing keys are shared by every node. Run a single binary or a multi-node cluster behind a load balancer — a two-node demo stack ships in the repo.
Built for AI agents
First-class support for agentic workloads: DPoP sender-constrained tokens, RFC 8693 token exchange with per-call audience/scope attenuation, and CIBA human step-up approval — with end-to-end MCP guides and recorded demos.
Federation & MFA included
LDAP, Active Directory, and Kerberos/SPNEGO user federation; identity brokering with Google, GitHub, and Microsoft; TOTP, WebAuthn/passkeys, and email-code login. No enterprise edition — everything is in the open repository.
issuerd is free and open-source software, released under the Apache-2.0 license. The full source, the conformance evidence, the performance methodology, and every benchmark script are public in the GitHub repository. The Issuerd name and logo are unregistered trademarks of the project — see the trademark policy.
Found a security issue? Please report it privately to security@issuerd.org — see the vulnerability reporting policy.
