# FoxAuth > Source-available OAuth 2.1 and OpenID Connect authorization server, built on OAuth-server.ts. Self-hosted or cloud-managed, with an admin console and an MCP control plane an AI agent can drive. ## Start here - [FoxAuth: the authorization server for the agent era](https://foxauth.dev/): One server for sign-in, APIs and AI agents: OAuth 2.1 and OpenID Connect, free on FoxAuth Cloud for up to 1,000,000 monthly active users per project. - [Run with Docker Compose](https://foxauth.dev/docs/get-started/docker-compose/): Start MongoDB, provision the schema and serve the authorization server with one command. - [Create the first administrator](https://foxauth.dev/docs/get-started/first-admin/): The one-time setup screen, how administrator sign-in works, and the second factor to turn on before anything else. - [Register your first client](https://foxauth.dev/docs/get-started/first-client/): Teams, projects and applications in the console, public versus confidential, and how a client decides which users it signs in. - [Get your first token](https://foxauth.dev/docs/get-started/first-token/): An Authorization Code plus PKCE walk-through with curl, from the challenge to a decoded ID token and a UserInfo call. - [Run from source](https://foxauth.dev/docs/get-started/from-source/): Clone the repository, provision the database and start the server with Bun. - [Protect your MCP server with OAuth](https://foxauth.dev/docs/get-started/protect-your-mcp-server/): Make your MCP server an OAuth 2.1 protected resource in ten minutes. Declare it in FoxAuth, publish its metadata, validate a token, and prove both outcomes. - [What do you need?](https://foxauth.dev/guide/): Answer two questions and see which sign-in setup fits: what happens step by step, what the person sees, and one button that sets it up. ## Product - [Contact](https://foxauth.dev/contact/): Reach the FoxAuth team: general enquiries at hello@foxauth.dev, vulnerability reports at security@foxauth.dev, and bugs on GitHub. - [OAuth 2.1 and OpenID Connect features](https://foxauth.dev/features/): Every grant, profile and control OAuth-server.ts implements: OAuth 2.1 with PKCE, DPoP, PAR, FAPI, CIBA and mTLS, an audited console, and OAuth for MCP servers. - [Pricing](https://foxauth.dev/pricing/): FoxAuth pricing: start free on FoxAuth Cloud, or self-host the whole server for free. Paid cloud plans are in development, and enterprise support is available. ## Compare - [Compare FoxAuth with Keycloak, Auth0 and others](https://foxauth.dev/compare/): How FoxAuth compares with Keycloak, Auth0, Zitadel, authentik and Ory Hydra on hosting, protocols, administration and licensing, dated and sourced. - [FoxAuth compared with Auth0](https://foxauth.dev/compare/auth0/): Auth0 is a managed identity service billed per monthly active user. FoxAuth is a server you run yourself or use on a free cloud plan. - [FoxAuth compared with authentik](https://foxauth.dev/compare/authentik/): authentik is a self-hosted identity provider covering SAML, LDAP and RADIUS as well as OIDC. FoxAuth does OAuth 2.1 only, with the banking-grade profiles. - [FoxAuth compared with Keycloak](https://foxauth.dev/compare/keycloak/): You can run Keycloak and FoxAuth yourself, and FoxAuth also has a free cloud plan. They differ in runtime, storage, scope and protocol defaults. - [FoxAuth compared with Ory Hydra](https://foxauth.dev/compare/ory-hydra/): Ory Hydra is an OAuth 2.0 and OpenID Connect server that delegates login to an app you write. FoxAuth ships the login, consent and admin screens itself. - [FoxAuth compared with Zitadel](https://foxauth.dev/compare/zitadel/): Zitadel is a multi-tenant identity platform with SAML and a managed cloud. FoxAuth is a smaller OAuth 2.1 server with the banking-grade profiles built in. ## Blog - [OAuth in practice](https://foxauth.dev/blog/): Notes on OAuth 2.1, OpenID Connect and running your own authorization server, written by the team building FoxAuth as we hit things worth writing down. - [An agent's connect link must check who opens it](https://foxauth.dev/blog/an-agents-connect-link-must-check-who-opens-it/): An agent hands a person a link to connect an account. If the link works for whoever opens it, a forwarded link connects the wrong account to the wrong agent. - [Deactivating a user does not end their access](https://foxauth.dev/blog/deactivating-a-user-is-not-deprovisioning/): A flag checked at the next sign-in leaves every session and token alive. How to end access at once, in what order, and what stays out of reach. - [Half of IPSIE SL1 cannot be a default](https://foxauth.dev/blog/half-of-ipsie-sl1-cannot-be-a-default/): IPSIE SL1 is the OpenID Foundation's enterprise sign-in profile. Half of it belongs in every server; the other half breaks other standards. When to use it. - [Okta Universal Logout is an expired draft](https://foxauth.dev/blog/okta-universal-logout-is-an-expired-draft/): Okta Universal Logout follows a draft no working group adopted, and it has expired. What Okta sends, the nbf timing trap, and checks no setting can relax. - [What DPoP protects you from, and what it doesn't](https://foxauth.dev/blog/what-dpop-protects-you-from/): A leaked access token works for anyone who finds it. DPoP ties it to a key the client keeps. What that stops, what it costs, and when I would skip it. - [What Entra and Okta send to a SCIM server](https://foxauth.dev/blog/what-entra-and-okta-send-to-scim/): A SCIM server that follows the standard's strict profile refuses the requests Entra and Okta send every day. Which requests, and why one setting is enough. - [Your MCP server must check who a token is for](https://foxauth.dev/blog/your-mcp-server-is-an-oauth-resource-server/): MCP authorization in plain terms: what your MCP server must publish, which token field must name it, and two questions the spec leaves to you. - [Your rate limiter won't stop password guessing](https://foxauth.dev/blog/your-rate-limiter-is-not-a-login-throttle/): A limit per IP address stops request floods, not password guessing. What a sign-in throttle has to count, where to keep the count, and four mistakes I made. ## Documentation - [Documentation](https://foxauth.dev/docs/): How to run, integrate and administer OAuth-server.ts, the engine behind FoxAuth, from a first container to a production deployment. - [Connected services](https://foxauth.dev/docs/administer/connected-services/): Let a project's users connect their accounts at Google, GitHub, Slack, Microsoft or another OAuth provider, and let the agents they allow obtain those tokens. - [End a user's access](https://foxauth.dev/docs/administer/ending-access/): Deactivate, lock, sign out everywhere or delete an end user. What each one ends at once, what survives it, and the one token none of them can reach. - [Connect an upstream identity provider](https://foxauth.dev/docs/administer/federation/): Let a project's users sign in through Google, Microsoft, Apple, GitHub or any OpenID provider, and decide which accounts such a sign-in may create or link. - [Groups and the groups claim](https://foxauth.dev/docs/administer/groups/): A group is a named set of one project's end users. Relying parties read a user's groups in the groups claim and decide for themselves. - [Turn on the IPSIE SL1 profile](https://foxauth.dev/docs/administer/ipsie-sl1-profile/): What the IPSIE SL1 enterprise profile changes, what it needs before it can be turned on, which applications it would refuse, and how to check before you switch. - [Plans and Free-tier limits](https://foxauth.dev/docs/administer/plans/): Limit what each team on a shared instance may create: projects, applications, APIs, enterprise sign-in and new sign-ups. Off by default. - [Project addresses](https://foxauth.dev/docs/administer/project-addresses/): A project is its own issuer at one address: a path, a subdomain or a hostname of its own. Who may choose which, and what the subdomain form needs. - [Provision users from Entra ID or Okta with SCIM](https://foxauth.dev/docs/administer/scim/): Connect Microsoft Entra ID, Okta or any SCIM 2.0 client to a project, so the directory creates, updates, deactivates and deletes its users and groups. - [Rotate signing keys](https://foxauth.dev/docs/administer/signing-keys/): Rotate a signing key in one step, retire the old one, or revoke a compromised key at once, for the instance and every project, with no restart. - [Teams and project ownership](https://foxauth.dev/docs/administer/teams/): Administrator teams own projects, and membership is the only grant of access. A project moves between teams with everything it holds. - [Sign-out from upstream providers](https://foxauth.dev/docs/administer/upstream-logout/): Let Okta Universal Logout end a user's access here, and let a sign-out at Keycloak, Auth0 or Ping end the sessions it began, with what each one reaches. - [Deploy with Docker Compose](https://foxauth.dev/docs/deploy/docker-compose/): A production-leaning Compose file, with pinned tags, a database you back up, and a TLS proxy in front. - [Deploy to Fly.io](https://foxauth.dev/docs/deploy/fly/): The shipped fly.toml, why the release command provisions the database, and which values are secrets. - [Deploy on Kubernetes](https://foxauth.dev/docs/deploy/kubernetes/): A Deployment, a Service, a provisioning Job that must finish first, and a caveat about scaling replicas. - [MongoDB Atlas](https://foxauth.dev/docs/deploy/mongodb-atlas/): The connection string, where the database name goes, network access, and what provisioning creates. - [PostgreSQL](https://foxauth.dev/docs/deploy/postgresql/): Choosing PostgreSQL instead of MongoDB, which variable selects it, how to provision the schema, and the migration step each upgrade needs. - [Behind a reverse proxy](https://foxauth.dev/docs/deploy/reverse-proxy/): Where TLS terminates, the setting with a wrong answer in each direction, and nginx and Caddy blocks that work. - [Upgrading](https://foxauth.dev/docs/deploy/upgrade/): Read the changelog, move the tag, re-run db:setup, apply migrations and restart. Five steps, and what each one is for. - [Security assurance](https://foxauth.dev/docs/security/assurance/): What backs the security claims, from the scanning that runs on every push and every week to where each result is published, and what has not been done yet. - [Threat model for OAuth-server.ts](https://foxauth.dev/docs/security/threat-model/): The assets, trust boundaries and attackers this authorization server is built against, and for each threat the control in the code and the test that holds it. ## Reference - [Addon seams](https://foxauth.dev/docs/reference/addon-seams/): The behaviour functions a deployment may replace at call time through the override registry. - [Admin API](https://foxauth.dev/docs/reference/admin-api/): The management API behind the console and the MCP control plane: reads, audited mutations and console-only operations. - [Attack reporting](https://foxauth.dev/docs/reference/attack-reports/): Which addresses a FoxAuth server reports to FoxTrust each hour, why, every field of a report, and how to turn it off. - [Endpoints](https://foxauth.dev/docs/reference/endpoints/): Every protocol endpoint with the flag that serves it, its CORS class and its rate-limit class. - [Environment variables](https://foxauth.dev/docs/reference/environment/): The only process environment the server reads. Everything else is a setting in the database. - [MCP tools](https://foxauth.dev/docs/reference/mcp-tools/): Every tool the administrative MCP control plane publishes, with its consequence class and input schema. - [Settings](https://foxauth.dev/docs/reference/settings/): Every server setting, grouped the way the console groups them, with its default and the flag it depends on. - [Usage reporting](https://foxauth.dev/docs/reference/telemetry/): Every field of the daily anonymous report a FoxAuth server sends, and how to turn it off. ## Project - [Changelog: every release of OAuth-server.ts](https://foxauth.dev/changelog/): Notable changes to OAuth-server.ts, release by release: new grants and protocol support, breaking changes, security fixes, and the version each shipped in. - [License: FSL-1.1-ALv2, and what you may do](https://foxauth.dev/license/): OAuth-server.ts is source-available under the Functional Source License 1.1, with Apache 2.0 as its future license. What that permits, and what it does not. - [Security policy](https://foxauth.dev/security/): Where to send a vulnerability report for OAuth-server.ts, what to include, how quickly we acknowledge and fix it, and what is in and out of scope. ## Full text - [Complete site](https://foxauth.dev/llms-full.txt): every page above, in full. - [Abridged documentation](https://foxauth.dev/llms-small.txt): the documentation with non-essential content removed. Every page is also available on its own as Markdown, at the page address plus `.md` — for example https://foxauth.dev/features.md.