Versola is a self-hosted OAuth 2.0 and OpenID Connect authorization server, an admin console to configure it, and an edge proxy that enforces authentication and authorization in front of your APIs. This page explains the parts and who they suit. To run it first, go to Run Versola locally.
Pre-1.0: Versola does not guarantee compatibility before 1.0.0. Configuration, database schema and APIs can change between 0.x releases without a migration path. Back up your database before upgrading.
What is in the box
| Part | Plane | What it does |
|---|---|---|
central and the admin console | Control | Holds all configuration. You manage tenants, clients, scopes, roles, permissions and resources in the console or through the Central API |
auth | Data | Authenticates users (password, OTP, passkey), issues tokens, serves the OIDC endpoints |
edge | Traffic | Reverse proxy for your APIs. Signs users in and keeps browser sessions, evaluates per-endpoint policies, and acts as the gateway for both browser and native mobile apps |
Each service has its own Postgres database in the standard topology. The local and VPS setups put all three in one database, one schema each.
flowchart TB
admin[["👤 Administrator"]]
user[["👤 End user"]]
subgraph versola["⚡ Versola"]
proxy["versola-proxy<br/><i>nginx</i><br/>Routing and admin console files"]
edge["edge<br/><i>traffic plane</i><br/>Sessions, policies, native gateway"]
auth["auth<br/><i>data plane</i><br/>OAuth 2.1 and OIDC server"]
central["central<br/><i>control plane</i><br/>Configuration and Central API"]
db[("Postgres<br/>one database<br/>schemas auth, central, edge")]
end
upstream{{"🔌 Upstream APIs"}}
notifications{{"📧 OTP delivery"}}
admin -->|Console and API| proxy
user -->|Login and API calls| proxy
proxy --> edge
proxy --> auth
edge -->|Token, PAR, userinfo| auth
edge -->|Console API calls| central
edge -.->|Sync| central
auth -.->|Sync| central
edge -->|Proxy| upstream
auth -->|Request OTP| notifications
central --> db
auth --> db
edge --> db
style admin fill:#92400e,stroke:#92400e,color:#fff
style user fill:#166534,stroke:#166534,color:#fff
style proxy fill:#334155,stroke:#e6edf3,color:#fff
style central fill:#155e75,stroke:#e6edf3,color:#fff
style edge fill:#155e75,stroke:#e6edf3,color:#fff
style auth fill:#155e75,stroke:#e6edf3,color:#fff
style db fill:#0e4a5c,stroke:#e6edf3,color:#fff
style upstream fill:#334155,stroke:#e6edf3,color:#fff
style notifications fill:#334155,stroke:#e6edf3,color:#fff
style versola fill:#eaf3f5,stroke:#155e75,stroke-width:2px,color:#15171c
For the detail, see Architecture.
Who it is for
Versola fits teams that run their own identity layer and want a configurable server with a proxy that applies the policy, instead of writing authorization code in every service. It runs on Docker (the CLI), on a single server, or on Kubernetes.
It is a pre-1.0 product. Check licensing before you plan a production use: the licence is not open source.
Licence
Versola is under the Versola Community License v1.0. It is free for internal authentication of employees in organisations with fewer than 50 employees, and any organisation may evaluate it for up to 90 days. Other production use needs a commercial licence. See licensing.
Where next
- Install the CLI and run Versola locally.
- Protect an API with edge.
- Build a native mobile sign-in.
- Entities: tenants, clients, resources, roles and the order to create them.