++
OAuth 2.0 client credentials · OIDC federation

Automate Machine‑to‑Machine Auth

Set up secure M2M authentication that scales in seconds. Built on OAuth standards for maximum security.

Read the docs →

Open source · Apache-2.0 · self-host it anywhere.

token exchangelive
01your-servicesdk.createToken('providerId', 'clientId')
02usegrant.devtrusted identity provider · issues accessToken
03aws stsAssumeRoleWithWebIdentity
01 — How it works

Trust-based Access

Set up UseGrant as a trusted identity provider on your preferred platform. Generate tokens from your identity provider and use them to access your API effortlessly.

UseGrant leverages OAuth standards, the most popular and secure protocols for authentication and authorization.

assume-role.ts
1
import UseGrant from '@usegrant/sdk';
2
import * as aws from '@aws-sdk/client-sts';
3
4
const sdk = new UseGrant('YOUR_API_KEY');
5
6
// get the token from usegrant
7
const resp = await sdk.createToken('providerId', 'clientId');
8
9
// use the token to assume a role
10
const command = new aws.AssumeRoleWithWebIdentityCommand({
11
RoleArn: 'arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME',
12
RoleSessionName: 'SessionName',
13
WebIdentityToken: resp.accessToken,
14
});
15
16
const stsClient = new aws.STSClient();
17
await stsClient.send(command);
02 — Verify

Validate tokens from any issuer

Tenants act as an identity broker. Trust external OIDC issuers like GitHub Actions and write policies that match claims with exact values or wildcards.

One call checks the signature, issuer, audience, expiry and token age before your service accepts the request. Give each customer their own tenant so their trust settings never mix.

validate.ts
1
import UseGrant from '@usegrant/sdk';
2
3
const sdk = new UseGrant('YOUR_API_KEY');
4
5
// OIDC token sent by a GitHub Actions job
6
const token = req.headers.authorization.slice(7);
7
8
// checks signature, issuer, audience, expiry and claims
9
const { exp } = await sdk.validateToken(
10
'tenantId',
11
'policyId',
12
token,
13
);
policy · main-branch
issuertoken.actions.githubusercontent.com
audienceapi.example.com
substringLikerepo:octo-org/octo-repo:*
03 — Architecture

Built to scale, built for security

Every component designed with zero-knowledge architecture and privacy-first principles.

[a]

Zero Trust

Complete data isolation with no visibility into your services or usage patterns.

[b]

Multi-Tenant

Isolated domain for each provider with enterprise-grade scalability.

[c]

Instant Provisioning

Instantly provision your tenant or provider in less than 200 milliseconds.

04 — Infrastructure

It's all virtual

No more spinning up physical servers. Scale up and down on the fly. Create providers and tenants instantly using the SDK or REST API, allowing you to establish trust-based access without manual configurations.

example topology
// issue tokens
provider/aws-prod
├─ client/billing-svc
└─ client/ingest-worker
// trust tokens
tenant/acme
└─ idp/github-actions
   └─ policy/main-branch
SDKREST APIno servers
05 — Integrations

Authenticate with any provider

Authenticate seamlessly with any platform that supports OAuth 2.0 client credentials grant.

Built on OIDC federation: each provider publishes its own discovery and JWKS endpoints, so cloud platforms verify useGrant tokens directly and exchange them for short-lived credentials. No long-lived keys to store or rotate in your services.

01
AWS
02
Google Cloud
03
Azure
04
Alibaba Cloud
05
Neon
06GitHub Actions
GitHub Actions
07Kubernetes
coming soonKubernetes
08Vault
coming soonHashiCorp Vault
06 — Open source

Self-host it. It's yours.

useGrant is open source under the Apache-2.0 license. Run it on your own infrastructure with Docker and Postgres, keep your signing keys in your own database, and use every feature without limits.

terminal
$git clone https://github.com/usegranthq/app.git usegrant
$cd usegrant
$cp .env.example .env
$docker build -t usegrant .
$DOCKER_REPOSITORY=usegrant docker compose up -d
Apache-2.0Docker + PostgresEvery feature included

Open source. Get started today.