Magnexis Identity.
Getting started.

1. Run the identity service locally

The repository includes an optional Keycloak + PostgreSQL environment in identity/provider/. Keycloak handles account management, token issuance, signing keys, OIDC discovery, and consent. The database persists local test accounts.

cd identity/provider
cp .env.example .env
# Choose strong, local-only credentials in .env
# Launch Docker Desktop first

docker compose up -d

After the development service is healthy, the issuer is http://localhost:8080/realms/magnexis. View its /.well-known/openid-configuration endpoint to inspect the discovery metadata. The imported development client is magnexis-local-web.

2. Register an application

In Keycloak’s admin console, create a separate OIDC client for each application. Enable the authorization code flow and require PKCE S256. Configure exact allowed redirect URIs and web origins. Public browser clients must not use embedded client secrets. Do not use wildcard production redirect URIs.

3. Install the browser SDK

Source is included under identity/sdk/. This is a private development package, not yet available on npm.

# From your application directory; replace path as needed
npm install ../path-to-magnexis/identity/sdk

import { MagnexisAuth } from '@magnexis/identity';

const auth = new MagnexisAuth({
  issuer: 'http://localhost:8080/realms/magnexis',
  clientId: 'magnexis-local-web',
  redirectUri: 'http://localhost:5173/callback',
  postLogoutRedirectUri: 'http://localhost:5173/',
});

// On user click:
await auth.signIn();

// On your configured callback route only:
const user = await auth.handleCallback();
console.log(user.profile.sub);

4. Discover endpoints

An OpenID Connect issuer publishes signed key discovery and metadata. Use its discovery document rather than hard-coding authorization or token endpoints:

5. Understand the deployment boundary

The public Magnexis website can deploy on Netlify, but the identity issuer must run on a long-lived, hardened service with TLS, protected administrative access, trusted mail delivery, backups, logging, and rate limiting. Never host real authentication by imitating it on a static Netlify form.