qopauth

qopauth is an open‑source authentication and authorization framework designed to provide secure, extensible access control for web applications and micro‑services. First released in 2019 by the software engineering team at OpenBits, qopauth was created to address the growing need for lightweight identity solutions that could run natively in containers and adapt to evolving regulatory requirements. The framework is built in Go, exposing a RESTful API that supports OAuth 2.0, OpenID Connect and JSON Web Token (JWT) workflows. It can be integrated with existing identity providers such as Keycloak, Auth0 or custom LDAP directories.

The core of qopauth consists of three modular components: the policy engine, the token service and the client SDK. The policy engine evaluates access requests against JSON‑based rules, allowing administrators to express permissions in a declarative way. The token service issues short‑lived JWTs and opaque tokens, and is responsible for refreshing, revoking and auditing token use. The client SDK, available for Go, Python, JavaScript and Java, simplifies token acquisition and validation inside target applications.

Security features include support for multi‑factor authentication, pluggable credential back‑ends, and encrypted storage of secrets in HashiCorp Vault, AWS Secrets Manager or Azure KeyVault. Auditing hooks emit detailed event logs through Syslog and structured logs, enabling integration with SIEM tools. Qopauth is distributed under the Apache 2.0 license and is actively maintained on GitHub, where contributors regularly add new connectors and enhance the documentation. The project has been adopted by a number of startups and medium‑sized companies looking for a simple yet robust solution for managing user identities and permissions across distributed systems.