FerriskeyKey capabilities
OAuth2 & OIDC
Connect any OAuth2 or OpenID Connect provider: Google, GitHub, Discord, Entra ID, or a custom corporate IdP.
Auto Provisioning
New users are created in FerrisKey on their first federated login, with nobody provisioning them by hand.
Account Linking
A user can link several providers to one FerrisKey account, with Google and GitHub pointing at the same identity.
Attribute Mapping
Map external claims (email, name, preferred_username) to FerrisKey user fields with required/optional rules.
Secret Encryption
Client secrets are encrypted at rest and never exposed in plaintext through the admin API.
Per-Realm Config
Each realm has its own provider registry. Isolate SSO configuration between tenants or environments.
How it works
User chooses provider
On the login page, the user selects an external provider (e.g. "Sign in with Google").
Redirected to IdP
FerrisKey builds the OAuth2 authorization URL and redirects the user to the external provider.
Callback processed
The IdP redirects back with an authorization code. Abyss exchanges it for tokens and fetches user attributes.
User provisioned
Abyss matches or creates a FerrisKey user, applies attribute mappings, and issues FerrisKey tokens.
Ready to use Abyss?
Full reference, configuration options, and examples in the documentation.