title	description	section	sectionOrder	order
idp.global identity platform	Integrate accounts, organizations, federation, strong authentication, and trusted-device approvals with idp.global.	Overview	10	1

idp.global identity platform

idp.global is identity infrastructure for applications that need accounts, sessions, organizations, invitations, role-based authorization, OIDC integrations, enterprise federation, and trusted-device approval flows. It provides a hosted browser experience, typed TypeScript clients, standards-based HTTP protocols, and operational endpoints for production deployments.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

Documentation status

These pages describe the current v10 application line, with @idp.global/app 10.3.3, @idp.global/interfaces 25.2.1, and @idp.global/sdk 14.3.0 as the source baseline. The running version is exposed by GET /healthz and GET /readyz; automation should inspect those responses instead of assuming a version from this page.

The packaged executable composes the production audit runtime from environment configuration. Readiness requires a valid current schema, a completed bootstrap, MongoDB, healthy audit protection and storage providers, durable dead-letter alerting, and successful background startup. A 200 health response proves only the checks represented by that endpoint; it is not a compliance certification or an assurance report.

Platform surface

Area	Implemented source capability
Accounts	Registration, login, sessions, password recovery, profile management, suspension, and deletion workflows
Organizations	Tenant organizations, invitations, memberships, ownership, custom roles, capabilities, and app connections
OIDC and OAuth	Discovery, JWKS, authorization code with PKCE, token refresh, UserInfo, revocation, and RP-initiated logout
Enterprise federation	DNS-verified SAML connections, JIT provisioning, role mapping, and organization-scoped SCIM 2.0
Strong authentication	TOTP, backup codes, WebAuthn passkeys, fresh-auth operation classes, and controlled administrator recovery
Passport	Trusted-device enrollment, signed approval challenges, alerts, push registration, and Apple companion apps
Operations	Exact current-schema validation, explicit initial bootstrap, production audit composition, health/readiness lifecycle, metrics, namespace and release preflights, and immutable deployment declarations

Package map

Package	Documented version	Responsibility
`@idp.global/app`	10.3.3	Server, web application, protocol routes, persistence, and domain managers
`@idp.global/interfaces`	25.2.1	Shared data, DTO, tag, and TypedRequest contracts
`@idp.global/sdk`	14.3.0	Browser authentication client and explicit server-side account helpers
`@idp.global/catalog`	7.1.2	Reusable idp.global web components and visual language

Start here

Choose the path that matches your role:

Application developers: choose an integration, then follow the browser SDK tutorial or the OIDC relying-party walkthrough.
Identity administrators: manage organizations, roles, and invitations, strong authentication and Passport, SAML federation, or SCIM provisioning.
Platform administrators: review OIDC client administration, runtime configuration, deployment and bootstrap, and observability and recovery.
Contributors: set up local development, use the SDK reference, and navigate TypedRequest contracts.

Current and planned boundaries

The current implementation supports authorization code with S256 PKCE and refresh tokens. It does not expose the client-credentials grant or legacy API-token login. Enterprise federation is SAML service-provider federation; organization-to-organization OIDC federation is not implemented. SCIM intentionally omits bulk, sorting, password changes, POST search, and arbitrary filter or PATCH grammar.

Those omissions are boundaries, not implied roadmap commitments. Consult the discovery documents and published interfaces for the contract accepted by a specific deployment.

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository license file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md