Hanko

Hanko is an authentication and user management server. It provides
passkeys, passwords, email passcodes, multi-factor authentication,
OAuth and SAML single sign-on, sessions and JWT issuing through a
public API, plus an admin API for user management. Pair it with the
Hanko Elements web components or your own frontend.

Hanko stores its data in an external PostgreSQL, MySQL, MariaDB or
CockroachDB database; no database is bundled.

Examples

sudo hanko migrate up

sudo hanko serve all

sudo hanko user import users.json

sudo hanko config show

hanko version

The commands read /var/snap/hanko/common/config.yaml, which holds the
generated encryption key and is readable by root only. Use --config to
pick another file.

Background service

The service is installed disabled. It applies database migrations and
runs the public API on 127.0.0.1:8000 and the admin API on
127.0.0.1:8001. Point it at a database and start it:

sudo snap set hanko database-url='postgres://hanko:secret@db.example.com:5432/hanko?sslmode=require'

sudo snap start --enable hanko.daemon

WebAuthn origins, CORS, SMTP and the other settings are in
/var/snap/hanko/common/config.yaml; restart the service after editing:

sudo snap restart hanko.daemon

The admin and optional multi-tenant management APIs have no authentication.
Keep them on localhost or behind an access-controlled proxy.