A small Rust + Axum service that adds OIDC login in front of apps that don't speak OIDC themselves, via Caddy's forward_auth directive. Built for the "one OIDC provider, a few subdomains" case — config ergonomics over generality, single instance, SQLite for session storage, no external dependencies to run.

Start here:

• Quickstart — authward init walked through end to end, get something running before reading the rest.
• Deployment guide — the binary, the config file, the trust-boundary requirement, and the Caddy setup.
• Config reference — every field on [global], [idp], [domain] (and its fallback), and [host].
• Operational runbook — key rotation, adding a host, domain or IdP, reading logs/traces for an auth failure, revoking access.
• API tokens — resource-scoped bearer tokens for non-browser clients (CLIs, scripts), worked through on pocket-id.

See forward-auth-plan.md for the full design rationale and locked-in decisions this implementation follows, and examples/config.toml / deploy/Caddyfile for copy-and-edit starting points.

Screenshots

	Light	Dark
Dashboard
API token

Building

cargo build --release

Testing

cargo test

tests/login_flow.rs runs the full login/refresh/authorization/API-token suite against an in-process mock IdP. tests/caddy_integration.rs drives the same flow through a real caddy binary if one is available on PATH (or CADDY_BIN), and skips itself with a message otherwise. tests/nginx_cache_integration.rs checks that cached /verify answers never cross users, apps, API tokens or paths behind a real caching nginx, run via rootless podman (or a native binary via NGINX_BIN); it skips itself when neither is available.

License

authward is free for personal use, hobby projects, research and noncommercial organizations under the PolyForm Noncommercial License 1.0.0. It is source-available rather than open source: commercial use needs a separate license.