Issuerd
Fast, Keycloak-compatible IAM with DPoP and CIBA
FreeOpen SourceSecurityAuth10 impressionslaunches Nov 31 comment
Comments
>log in to commentHi, I’m Dmitry, the maintainer of Issuerd. I built it for teams that know Keycloak’s model but want a Rust service shipped as one binary, and for agent workflows where bearer tokens and standing privileges are not enough. DPoP, token exchange and CIBA are implemented and demonstrated end to end not just listed as roadmap items. The project is still at v0.1.x. SAML, UMA, FGAP and Organizations are not implemented. I would especially value feedback from Keycloak operators on migration gaps and from teams evaluating DPoP or CIBA for agent access. GitHub: https://github.com/issuerd/issuerd Docs and quickstart: https://issuerd.org
Issuerd is an open-source, Keycloak-compatible IAM server written in Rust that provides OIDC/OAuth2, DPoP, CIBA and token exchange.
- for
- Teams needing self-hosted, standards-compliant identity and access management.
- pricing
- open source
- license
- Apache-2.0
Key features
- OpenID Certified — Provides OpenID Certified support for 11 OP profiles with zero conformance failures.
- Keycloak-compatible API — Implements Keycloak’s domain model and Admin REST API for drop-in compatibility.
- DPoP & Token Exchange — Supports RFC 9449 DPoP sender-constrained tokens and RFC 8693 token exchange for agents.
- CIBA Poll Mode — Enables human-in-the-loop step-up approvals via CIBA poll mode.
- LDAP/AD Federation — Synchronizes users and groups from LDAP/Active Directory with fast import performance.
- Single Binary Deployment — Runs as one self-contained Rust binary with Docker images, no JVM required.
Use cases
- Self-hosted IAM for internal applications
- Secure agent-to-service calls using DPoP-bound tokens
- Human step-up approvals for privileged actions via CIBA
- Large directory sync from Active Directory
- Stateless token validation in a horizontally-scaled cluster
Issuerd vs alternatives
 Issuerd |  Auth0 |  Zitadel |  Keycloak |  WorkOS | |
|---|---|---|---|---|---|
| Best for | Keycloak-compatible IAM in Rust | Managed cloud authentication | Open-source multi-tenant IAM | Keycloak-compatible Rust IAM | Enterprise SSO APIs |
| Pricing | Open source | Subscription | Free | Free | Subscription |
| DevHunt upvotes | 1 | 0 | 0 | 0 | 0 |
| Launched | Nov 2026 | — | — | — | — |
- Issuerd vs Auth0: Auth0 is a hosted SaaS solution, while Issuerd is self-hosted and Rust-based.
- Issuerd vs Zitadel: Zitadel offers multi-tenancy and SSO as open source, but Issuerd focuses on Keycloak compatibility and Rust performance.
- Issuerd vs Keycloak: Keycloak is Java/JVM based with broader feature set (SAML, UMA), whereas Issuerd is a lightweight Rust binary without those features.
- Issuerd vs WorkOS: WorkOS provides enterprise SSO and directory sync as APIs, while Issuerd is a full IAM server you run yourself.
Issuerd FAQ
Is Issuerd compatible with existing Keycloak configurations?+
Yes, it mirrors Keycloak’s realms, clients, roles, and Admin REST API, and is continuously diff-tested against a live Keycloak 24.0.
What runtime does Issuerd use?+
It is a single Rust binary using async Tokio, providing memory safety without a garbage collector.
How does Issuerd handle clustering?+
Cluster state is stored in PostgreSQL for signing keys and Redis for transient coordination, allowing stateless token validation.
Does Issuerd support multi-factor authentication?+
It includes TOTP and WebAuthn/passkey MFA, as well as passwordless email-code login.
Is there a Docker image available?+
Yes, Docker Hub and GHCR images are provided for easy deployment.
Summarized by DevHunt from github.com · Oct 30, 2026. Details may change; check the official site.
