ID

The challenge

I run a family of small, self-hosted apps: a tracker, invoicing, mail, a calendar, monitoring and a few more. Each one needed a login, and the usual answers were all bad. A separate password per app means a dozen things to leak, reuse or forget. A shared password database means one more thing to protect. I wanted one identity that every app trusts, with no passwords at all.

What I built

• A standalone identity provider on Laravel: an OAuth2 and OpenID Connect server (authorization code with PKCE) built on Laravel Passport, with discovery and key endpoints so apps can verify tokens themselves.
• Passwordless sign-in only. People sign in with a one-time code sent by email or with a passkey. There is no password column anywhere in the database.
• Per-app access control: a user only gets into the apps they have been granted, and the user-info endpoint enforces it, so revoking access takes effect everywhere at once.
• A portal that lists the apps a person can open and launches them in one click, with a registration screen for adding a new app, setting its colour and redirect addresses.
• Back-channel logout, so signing out of one app can end the session in the others, with retries when an app is briefly unreachable.
• A small client package that other apps install to get "Sign in with Thijssensoftware" in a few lines, so adding single sign-on to a new app is a short job rather than a new auth system.

Key decisions

• No passwords, ever. A one-time code and passkeys cover every case I have, and there is nothing to breach or reset.
• Sign-in lasts until you sign out. A short session that surprises people with a logout is worse than a long one, so the session is restored quietly instead.
• Trust at the boundary. Each app checks both the token and the per-app access list, so a valid login alone is not enough to get in.