Token exchange (RFC 8693), client credentials, authorization code + PKCE, dynamic client registration (RFC 7591), authorization server discovery (RFC 8414), UserInfo, JWT/JWKS verification, application credentials, and the AccessContext delegated-access container.

Rack middleware for validating authorization tokens from Keycloak

A rails wrapper for open source SSO project Keycloak.

Add authentication to applications and secure services with Keycloak

Library for using keycloak authentication with Rails

Keycloak ruby client

Idiomatic Ruby facade over rack-oauth2 (auth) and the Keycloak Admin REST API, with a self-hardened JWT validator. Isomorphic to the Java/Python/Node/Go/C#/PHP/Rust SDKs.

Manage application level keypairs with automatic rotation and JWT support

Open source children's ministry platform. Mountable Rails Engine with React/Vite frontend, Rodauth-powered passwordless auth, and bidirectional Planning Center Online sync.

Integrate the Kinde API into any ruby-based applications, Rails or non-Rails

kiosk-server is the host-side surface for Kiosk. The full surface ships: - The controllers — the per-verb endpoints (GET <endpoint>/<query-name>, POST <endpoint>/<action-name>) and the reserved endpoints (/kiosk/schema, /kiosk/pay), a derived OpenAPI description of both, OAuth client registration (RFC 7591) and the token endpoint (private_key_jwt client assertions, DPoP), JWKS, the KYC attestation endpoint, agents.txt / agents.json / kiosk.json discovery, and the account-binding ceremony (RFC 8628 device authorization and token poll, the verify and «Link an assistant» pages). - Kiosk::Server::Executor — dispatches a resolved command to the queries and actions the host registered. - Client registration and authentication, with a pluggable agent-IdP. - The proof-of-work toll that a kiosk-reputation policy sets (soft dependency; zero overhead when no policy is set). - A Rack middleware injecting the Kiosk-Server-Version / Kiosk-API-Version / Kiosk-Min-Client response headers, a pure-Ruby builder for the discovery documents, SQL generators for the canonical schema migrations, and a `kiosk:install` generator that lays down the initializer and the migrations. The Rails engine serves that whole surface from one `kiosk` block in config/routes.rb, which mounts it at Kiosk.configuration.mount_path — drawing the verb/auth/JWKS/KYC/binding routes under the mount and installing the root-relative discovery routes (agents.txt, .well-known) into the host — then one route per query and action the block names. It also auto-injects the headers middleware.

kiosk-test-support is the framework-agnostic test surface a Kiosk provider uses on their OWN application. It carries two things. The CONFORMANCE CHECKS assert the four properties the protocol makes normative of an origin: that its routes resolve, that a verb executes, that a query answers the shape it declared, and that data access is scoped to the authenticated principal. They ship with a Minitest adapter and an RSpec adapter, both loaded by explicit require, so the same fault reads identically in either framework. The JOURNEY DSL carries the identity-scoped call helpers (`as_agent_of`, `as_user`, `as_agent`, `as_anonymous`, `query`, `run_query`, `run_action`, `pay_action`, `kiosk_seed`), the pluggable executor contract, a NullExecutor for self-tests, and the structured error classes (`RLSDenied`, `QuotaExceeded`, `ExecutorNotConfigured`). It is connected to RSpec by `kiosk-rls-rspec` and into Minitest by `kiosk-rls-minitest`. The ASSISTANT drives an origin over HTTP as an assistant does: it registers, solves proof-of-work tolls, queries, runs, pays with signed mandates and listens on the event stream. `Kyc` stands in for the operator's KYC provider, and `StripeMock` fronts a local stripe-mock. `InProcessExecutor`, `InProcessWire` and `Conformance::InProcessOrigin` run against kiosk-server, and `Person` signs in through kiosk-user-idp-devise; both are dependencies. The host's bundle brings the rest: the Minitest and RSpec adapters use the test framework the host runs, `LiveServer` serves the app with Puma, and `Wire` solves Equihash tolls with kiosk-pow-equihash.

apple push notifications using only the new p8 format not the older pem format. fork from p8push

Description of KnockKnock.

Authentication solution for Rails based on JWT

Authentication solution for Rails 3 based on JWT

A gem for KooKoo markup

Pet gem

Validate KRN JWT Tokens

Lanes is a framework for writing single page web applications. It's a full stack framework that contains both server and client.