Introduction

Authkestra is an embedded identity engine for Rust: authentication and authorization logic that lives inside your application rather than a separate service you run alongside it. The core, authkestra-engine, is pure Rust with no web framework baked in — it defines the traits (Provider, AuthMethod, Flow, SessionStore, KvStore) and the Engine orchestrator built with a typestate builder, so a misconfigured stack fails to compile instead of failing at runtime.

Framework support is added through thin adapter crates — authkestra-axum and authkestra-actix — that translate the engine’s types into extractors and middleware for each framework. Everything the engine needs to persist (sessions, OAuth client state, OP tokens) is defined behind storage traits rather than a fixed schema, so you bring your own database and your own user table; Authkestra doesn’t have one.

On top of that core, authkestra-providers and authkestra-oidc supply concrete OAuth2/OIDC providers, and authkestra-op lets you run your own OpenID Connect Provider instead of only consuming one.

Where to start

QuickstartGet a working GitHub OAuth2 login running end to end.

Framework IntegrationWire the engine into Axum or Actix-web.

Authentication FlowsAdd a specific method: OAuth2, OIDC, passkeys, TOTP, device flow, and more.

Building ServersRun a resource server or your own OpenID Provider (OP).

Data & StorageChoose and implement the stores the engine reads and writes.

Why Authkestra?The design principles behind the typestate builder, stateless OAuth, and the trait-based storage model.

Try it, read it

Try the flows in a live sandbox at play.authkestra.com, or browse the source and open an issue on GitHub.