Self-hostable identity for your whole ecosystem

One login for every project you ship.

LIGHT HOPE Auth is a centralized authentication service — passwordless email login, Google OAuth, RS256-signed JWTs and single sign-on — with drop-in SDKs so any app trusts the same identity in minutes.

Get started → View integration

Passwordless & OAuth · RS256 JWT · Python & Node.js SDKs · Self-hosted

app.py

# Protect any Flask route with the shared ecosystem identity
from lighthope_auth import LightHopeAuth

auth = LightHopeAuth(app, public_key=PUBLIC_KEY,
                    auth_url="https://auth.lighthope.com")

@app.route("/dashboard")
@auth.require_login
def dashboard():
    return f"Hello, {auth.current_user['name']}"

Capabilities

Everything you need to authenticate — nothing you don't

A focused identity layer that your services can trust with a single public key.

Single sign-on

One identity across all your apps. Sign in once; every project that verifies the token knows who the user is.

Passwordless email login

Users receive a one-time verification code by email — no passwords to store, leak, or reset. Delivery via SendGrid or SMTP.

Google OAuth 2.0

Full authorization-code flow with CSRF state protection, verified-email enforcement, and open-redirect guards built in.

RS256 JWTs

Tokens are signed with an RSA private key and verified anywhere with the public key — your services never share a secret.

Token lifecycle & revocation

Short-lived access tokens, refresh-token rotation, and a server-side denylist so logout revokes credentials instantly by JTI.

Role-based access

A clear role hierarchy — from anonymous to admin — enforced from signed claims only. Client query params can never escalate.

Drop-in SDKs

Official Python (Flask) and Node.js/TypeScript (Next.js & Express) SDKs. One decorator or middleware protects a route.

Secure by default

HttpOnly + Secure cookies, per-IP rate limiting on sensitive endpoints, CSRF protection, and fail-safe authorization checks.

Health & metrics

A real database-probing health check and a Prometheus /metrics endpoint make the service easy to run in production.

Integrate in minutes

Trust one identity from any stack

Point your app at the auth service, hand it the public key, and protect routes with a single decorator or middleware. The same JWT is verified everywhere.

1Deploy the auth service (Docker) and generate an RSA key pair.
2Install the SDK and give your app the public key + auth URL.
3Wrap protected routes — unauthenticated users are sent to the shared login.

# pip install lighthope-auth
from flask import Flask
from lighthope_auth import LightHopeAuth

app = Flask(__name__)
auth = LightHopeAuth(
    app,
    public_key=PUBLIC_KEY,
    auth_url="https://auth.lighthope.com",
)

@app.route("/dashboard")
@auth.require_login
def dashboard():
    user = auth.current_user
    return f"Hello, {user['name']}!"

// npm i @lighthope/auth-sdk
import { LightHopeAuth } from "@lighthope/auth-sdk";
import { NextResponse } from "next/server";

const auth = new LightHopeAuth({
  authUrl: "https://auth.lighthope.com",
  publicKey: process.env.LIGHTHOPE_PUBLIC_KEY,
  projectId: "my-app",
});

export function middleware(req) {
  const user = auth.requireAuth(req);
  if (!user) return NextResponse.redirect(auth.getLoginUrl(req.url));
  return NextResponse.next();
}

# 1. Request a one-time login code
curl -X POST "https://auth.lighthope.com/api/v1/auth/login/email/send-code" \
  -G --data-urlencode "email=you@example.com"

# 2. Exchange the code for tokens
curl -X POST "https://auth.lighthope.com/api/v1/auth/login/email" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","code":"123456"}'

# 3. Call any endpoint with the access token
curl "https://auth.lighthope.com/api/v1/auth/me" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Sign-in options

Let people in the way that fits

Every method issues the same signed JWT, so your apps stay simple.

Email code

Passwordless one-time codes sent to a verified inbox. Rate-limited to resist abuse.

Google OAuth

Standard OAuth 2.0 authorization-code flow with CSRF state and verified-email enforcement.

Bearer & cookie

Accept tokens from an Authorization header for APIs, or HttpOnly cookies for browsers.

Where it fits

Built for teams running many apps

Stop rebuilding login in every service. Centralize identity once.

A single sign-on layer

Give a portfolio of internal tools and products one shared login and one user identity — no duplicate account systems.

Protect an internal dashboard

Wrap admin panels and back-office tools with one decorator. Role checks are enforced from signed claims, not client input.

Add auth to a new service fast

Spin up a service, install the SDK, verify the public key — protected in minutes instead of building auth from scratch.

Own your identity data

Self-host the whole service — your database, your keys, your users. No third-party lock-in for the front door to your stack.