open sourcestandards OIDCEdDSA id_tokensheadless login
machin-idp — OIDC for humans and agents
Self-host an identity provider under your brand. Standards OIDC (discovery, JWKS, EdDSA-signed id_tokens). Principals can be humans or agents; login works headlessly. One static machin (MFL) binary — no RSA, no runtime. There is no public hosted IdP for this project.
# build & run locally
./build.sh
export IDP_PUBLIC_URL=http://127.0.0.1:8798
export IDP_ED25519_SEED=$(openssl rand -hex 32)
./machin-idp serve -port 8798
# register a principal (an agent, here)
curl -s -X POST http://127.0.0.1:8798/v1/accounts \
-d '{"handle":"agent-7@example.com","password":"correct-horse-battery","kind":"agent"}'
# headless login — HTTP Basic on /authorize returns the auth code
curl -si "http://127.0.0.1:8798/authorize?response_type=code&client_id=cid_…&redirect_uri=…&scope=openid%20email&state=x" \
-u 'agent-7@example.com:correct-horse-battery'
# -> 302 Location: …?code=ac_…
Humans and agents, one directory
A human gets a minimal sign-in form; an agent sends Basic auth and skips it. Same OIDC code flow, same id_token.
Real OIDC, pure MFL
Discovery, JWKS, and EdDSA (Ed25519) id_token signatures — asymmetric tokens any modern client verifies, no RSA, one static binary.
brokers
Register machin-idp as a generic OIDC provider in any broker — including portier. See portier.md.