Neima ID
Sign inOpen portal

identity control plane

One identity for every Neima app.

Sign-on, access, and licensing — issued and verified from a single control plane. Passkeys to PGP on the front door; roles, license seats, and feature flags inside every token.

Sign in to Neima IDIntegration guide

issuer id.neima.me · OIDC + OAuth 2.1 · five sign-in methods · audited

sign-in accepted · passkey · example apptoken issued · audience example-client · exp 600slicense verified · sample key · seat 3/5feature enabled · sample-feature · example appsession revoked · another device · by owneraudit written · role grant · sample usernew device approved · mobile browserchallenge signed · PGP · verified
configured capabilitiessingle sign-ondirectorylicensingfeature flagsaudit

// control plane

One console for the whole identity stack.

Six subsystems behind one issuer. Everything ships through the same tokens, the same directory, the same audit trail.

six integrated capabilities

Single sign-on

capability

One Neima ID across every app. Standards-grade OIDC and OAuth 2.1 with PKCE — sign in once, land everywhere.

Five ways in

capability

Passkeys first, then TOTP, magic link, password, and a PGP signing challenge for the paranoid days.

Directory & roles

capability

Groups and per-app roles, resolved deterministically and stamped into every token as nid:roles.

Licensing

capability

Server-verified license keys with seat counts. Apps refuse to run without one — no honor system.

Feature flags

capability

Per-app flags and entitlements delivered inside claims. Flip a switch here; the app follows.

Audit & sessions

capability

Every privileged action lands in an append-only log. Sessions live in Postgres — revocable from anywhere.

// integration

Wire an app in an afternoon.

  1. 01

    Register your app

    A client id, redirect URIs, and scopes from the admin console. First-party apps skip the consent screen.

  2. 02

    Users sign in once

    Any method — passkey to PGP. Policy decides when a second factor is demanded, not the app.

  3. 03

    Ship with claims

    Roles, license seats, and flags arrive inside the token. Verify against JWKS and get back to your product.

Read the integration guide
id_token · RS256 · exp 600sverified
{
  "iss": "https://id.neima.me",
  "sub": "usr_01hzy4k8vq2e",
  "aud": "example-client",
  "nid:auth_level": "passkey+totp",
  "nid:roles": ["admin"],
  "nid:features": ["sample-feature"],
  "nid:lic": { "plan": "pro", "seats": "3/5" },
  "exp": 1783294920
}

// posture

Security is the product.

An identity plane earns trust by being boring under pressure. These aren't roadmap items — they're the substrate everything else is built on.

  • Sessions live in Postgres — revoke one device or all of them, instantly.
  • Persistent rate limiting on every auth endpoint. Restarts don't reset it.
  • Uniform responses and timing — no way to probe which emails exist.
  • Step-up MFA guards sensitive actions. Recent factor, or no entry.
  • Append-only audit trail with the resolved client IP on every event.
  • HSTS, strict CSP, and hardened headers on every response.
$ curl -sI https://id.neima.me

HTTP/2 200

strict-transport-security: max-age=31536000; includeSubDomains

content-security-policy: default-src 'self'; frame-ancestors 'none'; …

x-frame-options: DENY

referrer-policy: no-referrer

x-content-type-options: nosniff

permissions-policy: camera=(), microphone=(), geolocation=()

// access

Put your apps behind one identity.

Accounts are provisioned by realm administrators. Accept your secure invitation, add a passkey, and let the control plane handle the rest.

Sign in to Neima IDBrowse the help center

sso · rbac · licensing · flags · audit