A self-service UI and OAuth2 login / consent / logout bridge for Ory Kratos + Ory Hydra. Login, registration, recovery, MFA, consent and admin tooling — all server-rendered in Rust.
Ory's engines are excellent, but headless. You get APIs; your users need pages. Forseti fills that gap.
Login, registration, recovery, verification and settings — profile, password, MFA / TOTP, social logins, active sessions. No flow left as raw JSON.
Login, consent and logout screens for the authorization-code flow. The glue Ory leaves up to you, done properly.
Manage identities, sessions and OAuth2 clients. Append-only audit log and a status dashboard so you can see what's happening.
Multi-tenant orgs with members, invites and branding — plus per-org OIDC claims, so one deployment serves many tenants.
CSRF on every form, signed cookies, rate-limited Dynamic Client Registration, and an account-deletion webhook saga. The boring parts, handled.
Server-rendered in Rust on Axum — no JS-framework overhead. Backed by PostgreSQL or SQLite, your call.
Someone lands on /login, /registration or an OAuth2 /consent screen. Forseti serves a real, branded HTML page — not a redirect into an API.
It drives the Kratos self-service flows and the Hydra login / consent / logout requests over their admin APIs, handling CSRF, cookies and state along the way.
Kratos issues the session; Hydra issues the tokens for the authorization-code flow. Your app just trusts Ory — Forseti was only ever the front door.
The binary needs libpq5 (Debian/Ubuntu) or libpq elsewhere; the container bundles it. Point config.toml at your Kratos and Hydra admin endpoints — PostgreSQL or SQLite, both work.
The core is AGPL-3.0 — clone it, run it, change it. If you ship it as a service, the AGPL terms apply. Fair and predictable.
Some features live under src/commercial/ and need a commercial license. No upsell wall here — if you reach for them, you'll know. Details on GitHub →
Forseti is in active development. The core flows work end-to-end against the Ory playground, but the APIs, config and schema are still moving. Pin a release, read the changelog, and don't be surprised by breaking changes yet.