PandaAuth 1.0 is out
An open-source identity service you can self-host. Your users’ data stays on your own servers.
Building a product means building login: sign-up, password reset, two-factor. Every product needs it, it is hard to get right, and the cost of getting it wrong is high. PandaAuth turns it into a standalone service — your product connects through standard protocols (OIDC / OAuth 2.0), and sign-in, authorization and token management are handled in one place.
It is self-hosted: deployed on your own servers, with user data in your own database.
Who it is for
Developers and teams building products that need login; data-sensitive businesses that would rather not hand user passwords to a third-party sign-in service; anyone who can run Docker and is willing to maintain their own infrastructure. There is no hosted edition — deployment and maintenance are on you. That is the price, and the premise, of keeping your data yours.
What it has
Standard protocols: OIDC authorization code + PKCE, client credentials, refresh tokens. Mature libraries exist in every major language — integration does not lock your stack.
An admin console for users, clients and audit logs; admin write operations support two-factor.
Self-service MFA: users enable Passkey, TOTP or recovery codes themselves, no admin required.
Account security: email confirmation, email change, password recovery. Changing a password invalidates old sessions.
A .NET SDK: a minimal client that persists no tokens, with a machine-to-machine (M2M) sample.
Security, done for real
Passwords are hashed with Argon2id (OWASP baseline parameters) — a database leak is not a password leak.
Access tokens expire in 10 minutes with refresh-token rotation, keeping the leak window small.
Sign-in rate limiting, audit logs, signing-key rotation and enforced HTTPS are on by default.
The code is MIT open source. Security does not rely on a black box.
Where to get it
GitHub: github.com/PandaLabs2026 (five repositories: server / share / sdk / admin / me).
This release: github.com/PandaLabs2026/panda-auth-server/releases/tag/v1.0.0.
Product site (docs and live status): auth.pandalabs.cn.
PandaAuth just set out. If you have it running, the feedback we want most is from real use: what feels off, what is missing, where you put it to work — write to hello@pandalabs.cc, and we read every message. Product direction and priorities live on the roadmap page of the product site (auth.pandalabs.cn/roadmap).