Passkeys · OIDC · Official SDKs

Identity that ships with your apps

Register applications, grab client credentials, and integrate with Go, JavaScript, or Python. Standards OIDC with passkeys first — issuer on 0trust.cloud, apps and docs here.

Create application5-minute quickstartDocs
OIDC issuerhttps://0trust.cloudportal is never iss

Why teams start here

The Auth0-style workflow you already know — open issuer, passkeys first, SDKs that stay out of the way.

1

Applications dashboard

Create OIDC clients, copy client_id / client_secret once, set redirect URIs. Same cloud IdP your products already trust.

2

Standards OIDC

Discovery, authorization code + PKCE (S256), JWKS RS256, refresh tokens, userinfo, revoke. Works with any standards client.

3

Passkeys first

WebAuthn login and enrollment on 0trust.cloud. Device-bound sessions when your app needs stronger session binding.

4

Self-host ready

Pull platform images from hub.tunneltug.com and run your own issuer. SDKs only need OIDC_ISSUER.

Official SDKs

Install, set env, authorize. Full guides under Docs.

Go

otrust-go

Confidential and public clients, PKCE, ID token validation.

go get github.com/0TrustCloud/otrust-go
JS

@0trust/otrust-js

Node confidential clients and browser SPA helpers.

npm install @0trust/otrust-js
Py

otrust

Python OIDC client with env-based config.

pip install otrust
export OIDC_ISSUER=https://0trust.cloud\nexport OIDC_CLIENT_ID=\nexport OIDC_CLIENT_SECRET=\nexport OIDC_REDIRECT_URI=http://localhost:3000/callback

How it fits

0trust.codes

Developer portal. Create apps, read docs, install SDKs. Never the OIDC issuer.

0trust.cloud

Control plane and OIDC issuer. Passkeys, authorize, token, JWKS, userinfo.

tunneltug.com/hub

Container images and registry when you want to self-host the platform.

0trustos.com

Linux policy and provisioning agent for nodes on the mesh.

Ship something today

Open applicationsQuickstart0trust.cloud