Get ThunderID

ThunderID is available in multiple formats to suit your deployment needs. Choose the option that works best for you.

Building something? Start with a quickstart instead.

Quickstarts include setup and take you from zero to a working sign-in. Choose a quickstart from the sidebar.

Release Artifact

Get the latest release of ThunderID and run it locally on your machine.

Prerequisites

• Your operating system and architecture (macOS, Linux, or Windows)
• Terminal or command prompt access

1

Download the Distribution

Download the latest release from the releases page.

2

Extract the Archive

Unzip the downloaded file:

unzip thunderid-<version>-<os>-<arch>.zip

Navigate to the extracted directory:

cd thunderid-<version>-<os>-<arch>/

3

Setup ThunderID

Initialize ThunderID with the default configurations and data before starting the server for the first time.

Linux / macOS

./setup.sh

Windows

.\setup.ps1

Setup generates this deployment's own TLS, JWT signing, and encryption keys, in addition to seeding the default data, so every deployment uses unique key material. The keys are reused on later runs, and the server does not start without them.

4

Start ThunderID

Launch the ThunderID server:

Linux / macOS

./start.sh

Windows

.\start.ps1

Seed and start in one step

For local and development setups, you can combine both steps with the --bootstrap-and-serve flag. It creates or updates the default resources as needed (idempotent, so it's safe to re-run), then starts the server.

Unlike setup, this mode does not generate an admin password for you. You must provide one, either with the --admin-password flag or the ADMIN_PASSWORD environment variable. If neither is set, startup fails. The --admin-username flag is optional and defaults to admin, so passing just --admin-password is enough.

Linux / macOS

./start.sh --bootstrap-and-serve --admin-password <your-admin-password>

Windows

.\start.ps1 --bootstrap-and-serve --admin-password <your-admin-password>

This replaces the separate setup + start steps. For staged deployments (where initialization runs as a one-time job), keep the two steps separate: setup to seed, then start to serve.

Success

Access ThunderID on https://localhost:8090/console

Docker Compose

The quickest way to get ThunderID up and running with all dependencies configured.

Prerequisites

• Docker and Docker Compose installed on your machine
• Terminal or command prompt access

1

Start ThunderID

Run the following command to start ThunderID using Docker Compose:

docker compose -f oci://ghcr.io/thunder-id/thunderid-quick-start:latest up

note

This command will automatically:

• Initialize the database
• Run the setup process
• Start the ThunderID server

Success

Access ThunderID on https://localhost:8090/console

Helm

Deploy ThunderID on Kubernetes with PostgreSQL using Helm charts.

Prerequisites

• A running Kubernetes cluster (minikube or kind for local development)
• Helm and kubectl installed
• Terminal or command prompt access

1

Set Up the Database

Install PostgreSQL using the Bitnami Helm chart:

helm install postgresql oci://registry-1.docker.io/bitnamicharts/postgresql \
  --set auth.username=dbuser \
  --set auth.password=dbpassword \
  --set auth.postgresPassword=dbpassword \
  --set-file primary.initdb.scripts.setup\\.sql=<(cat <<'SQL'
CREATE DATABASE configdb;
CREATE DATABASE runtime_transient;
CREATE DATABASE entitydb;
CREATE DATABASE runtime_persistent;
GRANT ALL PRIVILEGES ON DATABASE configdb TO dbuser;
GRANT ALL PRIVILEGES ON DATABASE runtime_transient TO dbuser;
GRANT ALL PRIVILEGES ON DATABASE entitydb TO dbuser;
GRANT ALL PRIVILEGES ON DATABASE runtime_persistent TO dbuser;
SQL
)

Wait for PostgreSQL to be ready:

kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=postgresql --timeout=120s

Apply the database schemas:

kubectl run thunderid-dbinit --image=ghcr.io/thunder-id/thunderid:latest --restart=Never --command -- sleep 300
kubectl wait --for=condition=ready pod/thunderid-dbinit --timeout=60s
for db in configdb runtime_transient entitydb runtime_persistent; do
  kubectl exec thunderid-dbinit -- cat /opt/thunderid/dbscripts/$db/postgres.sql | \
    kubectl exec -i postgresql-0 -- env PGPASSWORD=dbpassword psql -U dbuser -d $db
done
kubectl delete pod thunderid-dbinit

2

Install ThunderID

Install ThunderID using the ThunderID Helm chart:

helm install thunderid oci://ghcr.io/thunder-id/helm-charts/thunderid \
  --set configuration.database.config.postgres.hostname=postgresql \
  --set configuration.database.config.postgres.sslmode=disable \
  --set configuration.database.runtime_transient.postgres.hostname=postgresql \
  --set configuration.database.runtime_transient.postgres.sslmode=disable \
  --set configuration.database.entity.postgres.hostname=postgresql \
  --set configuration.database.entity.postgres.sslmode=disable \
  --set configuration.database.runtime_persistent.postgres.hostname=postgresql \
  --set configuration.database.runtime_persistent.postgres.sslmode=disable \
  --set configuration.server.publicUrl=https://localhost:8090 \
  --set configuration.gateClient.hostname=localhost \
  --set configuration.gateClient.port=8090 \
  --set deployment.securityContext.readOnlyRootFilesystem=false

Wait for ThunderID to be ready:

kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=thunderid --timeout=120s

3

Access ThunderID

Forward the service port to your local machine:

kubectl port-forward svc/thunderid-service 8090:8090

Success

Access ThunderID on https://localhost:8090/console

What's Next

Explore Use CasesSee how the platform fits B2C apps, B2B organizations, and AI agents, with architecture patterns and ready-to-run samples.Browse use cases →

Manage ApplicationsRegister applications, configure OAuth settings, manage redirect URIs, and control access policies from the Console.Manage applications →

Build a Sign-In FlowUse the visual flow designer to configure authentication: add MFA, passkeys, or social login without changing app code.Open flow designer →