Identity Provider

Ship authentication in
just a few clicks.

Set up your application in Pramaan, grab your credentials, and use the official SDK to add secure authentication to your app.

Get Started See how it works

DEMO SHOWCASE

See Pramaan in action

Watch how a third-party application signs in users, verifies consent, and securely exchanges tokens via Pramaan.

See how OpenSpace uses Pramaan to authenticate users, handle consent, and securely exchange tokens.

HOW IT WORKS

Authentication in three clear steps

Built on battle-tested OAuth 2.0 and OIDC (OpenID Connect) standards — Pramaan handles authentication and identity, so your app can focus on building your product.

01

OAuth 2.0 Authorize

Redirect users via PKCE-enabled OAuth 2.0 authorization. Pramaan securely validates user credentials, executes multi-factor authentication, and requests user consent.

02

Token Exchange

Your backend securely exchanges the authorization code for an OAuth 2.0 access token and an OIDC ID token via the RFC-compliant token endpoint.

03

OIDC Verification

Verify token signatures offline using standard OIDC JWKS public keys, and query protected OIDC UserInfo endpoints using short-lived tokens.

IMPLEMENTATION

Add authentication with just a few lines of code

Drop in the official Node.js SDK to handle PKCE generation, callback exchange, and token verification effortlessly.

$ npm i @anuj304/pramaan

// ===================================================================
// Step 1 · Initialize SDK & Create Authorization Request (Auto-PKCE)
// Automatically generates code_verifier, code_challenge (S256), and state
// ===================================================================

import { PramaanClient } from '@anuj304/pramaan';

const pramaan = new PramaanClient({
  issuer: "https://pramaan.anujacharjee.com",
  clientId: process.env.PRAMAAN_CLIENT_ID,
  clientSecret: process.env.PRAMAAN_CLIENT_SECRET,
  redirectUri: "https://your-app.com/callback",
});

// Create PKCE-secured authorization URL & session transaction
const { url, transaction } = await pramaan.createAuthorizationRequest({
  scope: ["openid", "profile", "email"],
});

// Save transaction in user session and redirect user to Pramaan
req.session.oauth = transaction;
res.redirect(url);

// ===================================================================
// Step 2 · Handle Callback & Exchange Code (Auto-JWKS Verification)
// Validates state CSRF token, verifies PKCE challenge, and checks RS256
// ===================================================================

const tokens = await pramaan.handleCallback({
  code: req.query.code,
  state: req.query.state,
  transaction: req.session.oauth,
});

// Clean up one-time transaction state
delete req.session.oauth;

// tokens: { accessToken, idToken, tokenType }
// Automatically verified: constant-time CSRF, PKCE verifier, RS256 JWKS
req.session.tokens = tokens;
res.redirect("/dashboard");

// ===================================================================
// Step 3 · Fetch Verified User Claims (OIDC /userinfo)
// Returns standardized, fully-typed user profile claims
// ===================================================================

const user = await pramaan.getUserInfo(
  req.session.tokens.accessToken
);

// Access standard typed user claims directly
res.json({
  id: user.sub,
  name: user.name,
  email: user.email,
  picture: user.picture,
});

Step 1 of 3

WHY PRAMAAN

Secure by default. Built for developers.

Everything you need to ship enterprise-grade authentication with open protocols, cryptographic guarantees, and zero vendor lock-in.

OAuth 2.0 + PKCE

Full RFC 7636 Authorization Code flow with SHA-256 code challenge validation to protect against authorization code interception attacks.

OIDC Discovery & JWKS

Standardized .well-known configuration and RS256 JWKS endpoints for effortless client SDK integration and token signature verification.

Two-Factor Auth (TOTP)

Built-in authenticator app integration with QR code onboarding, time-based one-time passwords, and encrypted offline backup recovery codes.

Client Registry & DNS Check

Manage callback URIs, scopes, and rotated client secrets. Verify client domain ownership through automated DNS TXT record checks before production use.

Active Session Governance

Inspect device types, IP addresses, and geolocation across active sign-in sessions. Instantly revoke compromised sessions with single-click invalidation.

Rate Limiting & Lockouts

Redis-backed sliding window rate limiters protect authorization and token endpoints against brute-force attacks, with automatic account lockout shields.

Ready to launch your identity layer?

Create an account, register your first client, and start authenticating in minutes.

Sign up now

Ship authentication in just a few clicks.