PandaAuth Community Preview 0.2.0-preview.1
An open-source identity service you can self-host. Your users’ data stays on your own servers.
Published on 2026-09-25. The public suite version was reclassified on 2026-09-26 as Community Preview 0.2.0-preview.1.
It is self-hosted: deployed on your own servers, with user data in your own database.
Who it is for
Developers and teams building products that need login; data-sensitive businesses that would rather not hand user passwords to a third-party sign-in service; anyone who can run Docker and is willing to maintain their own infrastructure. There is no hosted edition — deployment and maintenance are on you. That is the price, and the premise, of keeping your data yours.
What it has
Standard protocols: OIDC authorization code + PKCE, client credentials, refresh tokens. Mature libraries exist in every major language — integration does not lock your stack.
An admin console for users, clients and audit logs; admin write operations support two-factor.
Self-service MFA: users enable Passkey, TOTP or recovery codes themselves, no admin required.
Account security: email confirmation, email change, password recovery. Changing a password invalidates old sessions.
A .NET SDK: a minimal client that persists no tokens, with a machine-to-machine (M2M) sample.
Security, done for real
Passwords are hashed with Argon2id (OWASP baseline parameters) — a database leak is not a password leak.
Access tokens expire in 10 minutes with refresh-token rotation, keeping the leak window small.
Sign-in rate limiting, audit logs, signing-key rotation and enforced HTTPS are on by default.
The code is MIT open source. Security does not rely on a black box.
Where to get it
GitHub: github.com/PandaLabs2026 (five repositories: server / share / sdk / admin / me).
PandaAuth just set out. If you have it running, the feedback we want most is from real use: what feels off, what is missing, where you put it to work — write to hello@pandalabs.cc, and we read every message.