Hanko

Hanko handles authentication and user management for an application without binding it to a vendor. It is framework agnostic and built on privacy-first principles, data minimalism and phishing resistance, which is why passkeys sit at the center rather than at the edge of its options.

The project divides into three building blocks. A lightweight backend exposes an API for passwords, passkeys, email passcodes, OAuth SSO, user and session management and JWT issuing. Web components called Hanko Elements provide onboarding, login and profile screens that are customizable with CSS, and a frontend SDK handles the API communication if you would rather build the interface yourself.

Configuration is where most of the flexibility lives.

• Modern methods: passwords, passcodes, passkeys and MFA using TOTP or security keys.
• Federation: OAuth SSO with Apple, Google and GitHub, SAML enterprise SSO and custom OIDC connections.
• Flexible modes: passkey-only, OAuth-only or user-deletable passwords, depending on how strict you want to be.
• Sessions: server-side sessions with remote revocation.
• Extras: webhooks, internationalization with custom translations and a JavaScript SDK.

A quickstart app demonstrates the login experience and doubles as a reference implementation, and Docker Compose files bring up the whole stack locally or just the backend once the extra services are stripped out. Hanko Cloud covers the managed case, and organizations, roles and permissions are listed as in progress.