P'adentro is one self-hosted authentication service every API on your stack delegates to. This page covers the core concepts; the full request/response reference is generated straight from the API's own OpenAPI spec.
Your API gets a tenant API key. During the private beta, an operator provisions the tenant and approves its permissions. End-user sessions are tenant-scoped; an identity is shared across tenants only through explicit tenant linking with the user's consent.
Resource-level permissions on a tenant's API key, such as users:read, users:write, memberships:read, memberships:write, audit:read and users:import. This is not a complete list; see the API reference.
Short-lived, signed PASETO access tokens your API can verify locally with P'adentro's public key. No call back per request, and no session store on your side.
Three kinds of credential reach the API, plus first-party service tokens. Which one a route needs is marked in the API reference.
Sent raw in the X-API-Key header, as <tenant-id>.<secret>. For your backend's calls to the API, limited to the scopes approved for the tenant.
Sent as Authorization: Bearer. Issued by login for one user in one tenant.
Also Authorization: Bearer, but the holder must be a Nod admin. Admin-only operations, including account anonymization (DELETE /v1/users/{id}), need it; users:write is not enough. Erasure anonymizes the account rather than deleting the row.
POST /v1/services/token issues first-party service credentials for a service audience, independent of tenants.
Access tokens are signed PASETO v4.public tokens, 15 minutes by default. Fetch the public key from GET /v1/auth/public-key and verify locally: the signature, iss (the configured issuer), aud (the tenant ID, or the requested service audience for service tokens), exp, and typ (access for end users, service for service tokens).
A valid signature proves the token was not tampered with. It does not prove it was not stolen: a stolen token works until it expires, so the offline revocation window is the token lifetime. There is no introspection endpoint yet. Membership and role checks are your application's job.
You need:
Every instance requires a valid license key issued by Nod-Corp. It is free of charge for personal and non-commercial use; commercial use needs a paid license. During the beta, join the waitlist or email hello@padentro.dev to get one.
The instance refuses to start with a missing, expired, or tampered license, and periodically makes outbound HTTPS license-status checks to Nod-Corp's issuer. Self-hosted does not mean air-gapped. If the issuer is unreachable, service stays full for about two hours and then degrades: tenant-key and end-user traffic keep working, while admin routes, including account anonymization, return 503. If the license is revoked or expired, service is full for one hour, degraded for 23 hours, then the instance shuts down gracefully.
This website sets no cookies and runs no trackers. Waitlist emails can be deleted on request: hello@padentro.dev