Staso

Authentication & tokens

Authentication and sessions, self-hosted.

Staso issues and verifies session tokens for your apps over a small API, so you keep auth in-house instead of renting it.

Read the documentation →$ staso serve
Staso APIv1
POST /v1/tokensIssue a session token.
GET /v1/verifyVerify a token from the Authorization header.
POST /v1/tokens/refreshExchange a refresh token for a new one.
DELETE /v1/sessions/{id}Revoke a session.

Capabilities

01

Issue & verify

Mint signed session tokens and verify them in one round trip, with short-lived access and refresh tokens.

02

Revocation

Kill a session or a whole user's sessions instantly — verification checks the live revocation list.

03

Simple integration

Two endpoints cover most apps: one to sign in, one to verify. No SDK required.

Staso Authentication·Token issuance·Session verification·Revocation·REST API

Sign in, verify, done.

Exchange credentials for a token, then verify it on each request.

  1. 1Start Staso on any host.
  2. 2Exchange credentials for a token.
  3. 3Verify the token on incoming requests.
# start the server $ staso serve --data ./auth # sign in $ curl -X POST /v1/tokens \ -d '{"user":"alice"}' → token eyJ... # verify a token $ curl /v1/verify -H 'authorization: Bearer eyJ...'