portier
agent-firstno per-seat taxpay-per-authone static binary

SSO for your app in one redirect.

Add "Login with Google / GitHub / any OIDC provider" without implementing OAuth. portier brokers the authorization-code flow and hands your app back a verified identity. No per-seat SSO subscription — 100 free auths, then 1 EUR per 100 successful auths, funded by a peage wallet. OSS binary (self-host) or this Intrane hosted instance (metered). Hostname = API + thin docs — not a separate marketing site.

Register an app →Read the contract

Quick start

Four curls. No OAuth code.

register · provider · wallet · exchange
# 1. register your app
curl -s -X POST https://portier.intrane.fr/v1/apps \
  -d '{"name":"my app","redirect_uris":"https://myapp.com/auth/done"}'
# -> {"app_id":"app_…","app_secret":"psk_…"}

# 2. add a provider (try the built-in demo first — no real IdP needed)
curl -s -X POST https://portier.intrane.fr/v1/apps/provider \
  -H 'Authorization: Bearer psk_…' -d '{"kind":"demo"}'

# 3. set a billing wallet (peage — funds auths past the free tier)
curl -s -X POST https://portier.intrane.fr/v1/apps/wallet \
  -H 'Authorization: Bearer psk_…' -d '{"wallet_token":"pw_…"}'

# 4. send the user to portier; get ?code= back at your redirect_uri; exchange it:
curl -s -X POST https://portier.intrane.fr/v1/token \
  -H 'Authorization: Bearer psk_…' -d '{"code":"pc_…"}'
# -> {"identity":{"sub":"…","email":"…","name":"…","provider":"github"}}

Why portier

i.

The auth glue, deleted

OAuth redirects, token exchange, userinfo, CSRF-safe state, open-redirect guards — portier does it. Your app makes two curls.

ii.

Pay only for logins that work

Billed per successful auth, in blocks of 100 (1 EUR), from a prepaid wallet. No MAU tiers, no annual contract.

Providers

Any door your guests use.

GitHub, Google, and any generic OIDC provider (Keycloak, Auth0, Okta, GitLab — supply the discovery URLs) — plus open-source machin-idp (self-host; docs). A built-in demo provider lets you test the whole flow with curl before wiring a real IdP. SAML is on the roadmap (it needs RSA/XML-DSig that the pure-MFL runtime doesn't have yet).

GitHubGoogleGeneric OIDCmachin-idpKeycloak · Auth0 · Okta · GitLabdemo providerSAML — roadmap

The interface is the docs

written for agents
curl -s https://portier.intrane.fr/llms.txt   # the full contract, written for agents
curl -s https://portier.intrane.fr/guide      # the same contract as JSON