Code
Open source
Apache 2.0 licensed. Use it, ship it inside your product, and modify it, with no proprietary licensing to pass on.
What's new in ThunderIDRead the release notesRelease notes
Open source identity for humans, AI agents, and machines
Authentication, authorization, and identity management, built for the agentic era. Native agent identity, post-quantum safety, and ready for digital wallets. A lightweight, high-performance Go runtime.
Apache 2.0 licenseBuilt with Go<50ms startup
Built on open standards
OAuth 2.1OpenID ConnectSAMLAuthZENOpenID4VCIOpenID4VPID-JAGMCPA2A
What is ThunderID?
Open source IAM, rebuilt for the decade ahead
ThunderID is a neutrally governed, open-source IAM stack built in Go, focused on open standards and designed to handle identity for humans, AI agents, and machines with fully orchestratable identity flows.
01AI agents now act on their own and on others' behalf.
Native agent identity
Agents are identities, not service accounts
Every AI agent is its own first-class identity, with an owning user and a managed lifecycle, and acts with delegated, auditable authority, keeping a human in the loop.
Supports
- OAuth 2.1
- Token exchange
- ID-JAG
- CIBA
- MCP authorization
- A2A authorization
02The digital trust has to hold up against quantum attacks.
Post-quantum safe by design
Tokens you sign today stay trustworthy tomorrow
ThunderID is crypto-agile from the core, with algorithms and keys set in configuration, so what you issue today holds up against harvest-now-decrypt-later and trust-now-forge-later attacks.
Supports
- ML-DSA
- ML-KEM
- SLH-DSA
- X25519MLKEM768 hybrid TLS
- Hybrid classical and post-quantum mode
03Credentials are moving to wallets.
Integrates with decentralized identity infrastructure
A bridge between today's identity systems and digital wallets
ThunderID connects the identity systems you run today with decentralized identity infrastructure, including wallets, verifiable credentials, DIDs, and trust registries.
Supports
- OpenID4VCI issuance
- OpenID4VP presentation
- Standard APIs for issuers, verifiers, and holders
04Identity infrastructure has to be lightweight and fast.
High-performance lightweight runtime with GitOps support
A Go-based, high-performance runtime that lives in Git
ThunderID is a lightweight, Go-based, high-performance runtime that runs headless and API-first, with identity flows, policies, and configuration declared in code, versioned in Git, and deployed through your existing pipelines.
Supports
- Docker
- Kubernetes
- Helm
- On-premises
- Cloud
Open foundations
Open in code, governance, and standards.
Governance
Open governance
An LF Decentralized Trust project. Design decisions, RFCs, and the roadmap happen in public on GitHub.
Standards
Open standards
Built on OAuth 2.1, OpenID Connect, SAML, SCIM, and AuthZEN, and on OpenID4VCI and OpenID4VP for wallets.
How you use ThunderID
Start where you are
Use ThunderID through the tools you already know, offer it to your users, ship it inside your product, build on it, or contribute back.
Secure your applications
Add identity to the apps you already build.
Add sign-in, authorization, and agent identity to your app through the auth libraries and frameworks you already use, starting with Better Auth. No new SDK to learn.
Framework guidesGive your users an open source identity provider option. ThunderID integrates through standard OpenID Connect, OAuth 2.1, SAML, and SCIM, with ready-to-use deployment artifacts.
Integration guidesShip it, build on it
Make ThunderID part of your own product.
Embed ThunderID as the identity layer of your product or distribution, so your users don't depend on an external identity provider.
Embedding guideBuild on it. Create your own specialized identity solution on an extensible core. Extend flows, authenticators, and attribute sources in Go, with full source-level control.Extension docs
Contribute back
Help shape where ThunderID goes next.
Improve the code. Fix bugs, add features, or propose a change through GitHub issues and discussions, so what you need ships for everyone. Start with a good first issue.
Contributing guideShare what you know. Write docs, samples, tutorials, or blog posts, or publish a connector or framework integration so others can build on your work.
Ways to contributeDevelopers
From npx thunderid to secured agents in a few lines.
SDKs for the frameworks you already use, a CLI for everything else, and APIs your agents can call safely.
Add sign-in to any app
Drop in the official SDK for React, Next.js, Vue, Nuxt, Express, Node.js, iOS, Android, or Flutter and ship secure auth today.
Browse quickstartsapp.jsLive
1import { ThunderIDClient } from '@thunderid/browser';2 3const auth = new ThunderIDClient({4 baseUrl: 'https://localhost:8090',5 clientId: '<your-client-id>',6 redirectUrl: window.location.origin,7});8 9document.querySelector('#login').onclick = () => auth.signIn();
10+
Official SDKs, from React to Flutter
6+
Identity types: humans, AI agents, machines, applications, wallets, MCP and more
100%
Open source, Apache-2.0
<50ms
Startup time for the Go runtime
Features
ThunderID features
Agents
Native agent identity
Agents as their own identity type, with delegation, token exchange, and CIBA
Trust & standards
Post-quantum safe
ML-DSA, ML-KEM, SLH-DSA, and hybrid post-quantum TLS
Trust & standards
Wallet integration
OpenID4VCI issuance and OpenID4VP presentation
Agents
MCP and A2A authorization
Secure agent-to-tool and agent-to-agent calls
Build
Composable flows
Login, registration, recovery, and step-up as flows, in a visual designer or as code
Build
Extensible
Extend flows and authenticators in Go
Platform
Deploy anywhere
Docker, Kubernetes, and Helm
Platform
Organization units
Organize users, agents, and applications in a hierarchy
Platform
GitOps
Declarative, versioned identity configuration
Platform
Console
Optional web console for the control plane, to configure identities, applications, and flows
Platform
Lightweight runtime
Written in Go, headless, API-first, and starts in under 50 ms
Trust & standards
Standard protocols
OAuth 2.1, OpenID Connect, SAML, and SCIM
Trust & standards
Authorization
Roles, groups, and AuthZEN-compatible policy evaluation
Get involved
Join the ThunderID community
ThunderID is built in the open, with an ever-growing community of contributors. Shape where it goes next.
© Copyright Linux Foundation Europe.For web site terms of use, trademark policy and other project policies please see https://linuxfoundation.eu/en/policies.