fulla
A high-performance identity & access core, built in C++17
A production-grade OAuth2 / OIDC authorization server that runs out of the box (Docker / Helm) — or embed it into your C++ project as an SDK (find_package(fulla-*)). Ships with an admin console, a user frontend, and official Python / Go clients.
Up and running in five minutes
One command pulls up the full stack: backend (OAuth2/OIDC) + PostgreSQL 17 + Redis + user frontend + admin console + Prometheus. Seed data is built in — sign in to the admin console with admin / admin and walk the whole flow.
Building from source (Conan 2 + CMake presets, same as CI) — see Docs · Get started.
# One command, full stack (recommended for evaluation)
docker compose -f deploy/docker/docker-compose.yml up -d --build
# User frontend http://localhost:8080
# Admin console http://localhost:8081
# Backend API http://localhost:5555/.well-known/openid-configuration
Why fulla
High-performance C++17 core
Async non-blocking Drogon framework with callback-based storage ports. Leads Keycloak, Ory Hydra and Zitadel in all five benchmark scenarios (discovery / client_credentials / introspect / refresh_token / userinfo).
Production-grade OAuth2 / OIDC
Authorization code + PKCE, client credentials, device flow, refresh rotation with reuse detection, introspection / revocation, OIDC discovery, RP-Initiated Logout, Backchannel Logout.
Embeddable C++ SDK
The protocol engine is decoupled from the server: the domain layer has zero Drogon dependencies. Take the eight static libraries via find_package(fulla-*) — or add_subdirectory from source; same SDK surface.
Full authentication coverage
TOTP MFA (second-factor session binding), WebAuthn/Passkeys, GitHub / Google / WeChat social login, progressive account lockout, and anti-enumeration-consistent auth failure handling.
RBAC + granular scopes
Dual-gate authorization — roles (admin / user / custom) plus resource scopes; roles are issued into JWT claims. Admin APIs cover the full lifecycle of users / clients / roles / scopes / tokens.
Production-ready operations
Prometheus metrics + six-level structured logging, account-lockout and PG-upgrade runbooks, a deployment acceptance checklist, Redis L2 caching (delayed double-delete consistency), and an official performance baseline.
Performance: ahead in all five scenarios
Same machine, same backend, against Keycloak 26 / Ory Hydra v26 / Zitadel v4 (WSL2 8 vCPU · PostgreSQL 17 · wrk ladder · each vendor’s official production config). Steady-state QPS below; “closest rival” is the best of the three. Full methodology and data: benchmark report.
Get started
Evaluate the architecture → run it → integrate → deploy to production: every step has a doc, and every key decision has an ADR behind it.