Sign in to your platform tools through Nauthera.

#How an integration works

Every tool here signs people in the same way, through OpenID Connect, with an OIDCClient beside it:

1. An OIDCClient in the tool's namespace. The namespace has to be admitted by an organization: for the main one, the chart value operator.mainOrganizationNamespaces; for any other, its Organization resource's spec.namespaces.
2. The tool's own OIDC settings point at the issuer, https://auth.example.com for the main organization or https://auth.example.com/orgs/<slug> for another.
3. A confidential client reads its secret from the operator's Secret, which holds the keys client-id, client-secret and issuer. A public client uses PKCE and needs no secret.
4. Roles map by email. Nauthera emits no groups claim; ID tokens carry email and email_verified with the email scope, and member_org_slug for people from organizations brokered by yours.

Each page says which version of the tool it was checked against, where those facts come from, and whether it has been run end to end.

#Your own applications

For applications you write, Connect an Application walks through the protocol, and the framework guides cover Better Auth, Spring Boot, Go and .NET. The GitOps guide shows how the clients ship with Argo CD.