Skip to content
Arnold Perez
Back to projects
Beta

Identity Platform

A greenfield identity provider: FastAPI + Postgres + Redis power registration/login, HttpOnly session cookies, WebAuthn passkeys, and an Authorization Code + PKCE server. A Vite React dashboard covers account, passkeys, and sessions; hosted OAuth login/consent serves third-party apps; an admin panel manages users, audit logs, and OAuth clients. Fieldkit is a public PKCE client served at /demo/ on the same host. Production runs as one Railway service (nginx + API + static) with managed Postgres/Redis so cookies and OAuth stay same-origin—Compose remains the local runtime; AWS CDK is scaffold-only for a later path.

View Live App(opens in a new tab)View on GitHub(opens in a new tab)
Identity Platform dashboard, hosted consent, and demo OAuth client

Tech stack

  • TypeScript
  • Python
  • FastAPI
  • React
  • PostgreSQL
  • Redis
  • Docker
  • NGINX
  • Railway

Architecture

  1. Authorization server API

    FastAPI under /api owns auth, sessions, WebAuthn, OAuth AS endpoints, and admin APIs over Postgres with Redis for session hot-path, challenges, and auth codes.

    • Cookie sessions (HttpOnly sid) with revoke + audit logging
    • WebAuthn register/login with env-based RP ID/origins
    • OAuth authorize → hosted UI → consent → token → userinfo (PKCE S256)

  2. Hosted identity UI

    Vite React SPA for the consumer dashboard and hosted OAuth login/register/consent that third parties redirect into.

    • Dashboard: passkeys and session management with credentials: include
    • OAuth routes preserve authorize query params through login → consent
    • Admin surfaces for users, audit logs, and OAuth client CRUD

  3. Demo client + Railway host

    Fieldkit at /demo/ is a public PKCE client on the same Railway hostname; nginx serves both SPAs and proxies /api so sid cookies work without a custom domain.

    • Browser PKCE → /api/oauth/authorize → callback token exchange → userinfo
    • Idempotent seed for admin user and demo-app redirect URI
    • Local Compose for Postgres/Redis; Dockerfile multi-stage image for Railway

Engineering highlights

  • Real AS, not just login forms

    Third-party apps integrate via standard OAuth discovery, authorize, token, and userinfo—admins register clients; integrators never need the monorepo.

  • Passkeys + password on one session model

    Email/password and WebAuthn both mint the same HttpOnly session cookie, so dashboard and hosted OAuth consent share one auth story.

  • Same-origin portfolio deploy

    One Railway URL serves Identity UI, Fieldkit (/demo/), and /api behind nginx—OAuth redirects and sid cookies work without splitting domains.

  • Redis-bound short-lived secrets

    Session lookups, WebAuthn challenges, and authorization codes live in Redis with TTLs so one-time values never harden into long-lived DB rows.

← All projects