# Modgud

> Multi-tenant Identity Provider

> Generated: 2026-09-10 · Source commit: 18b92a1 · Product: Modgud · Canonical: https://docs.cocoar.dev/modgud/ · Version: v0.13

Named after <em>Móðguðr</em>, the watcher of Gjallarbrú.<br><br>OAuth 2.0 / OpenID Connect server with multi-app permissions, granular RBAC, and full database-per-tenant isolation.<br><br>Drop-in for any ASP.NET Core resource server — and the auth foundation of the Cocoar suite.

## Table of Contents

### Get Started

- [Getting Started](/getting-started.md)
- [Quickstart (Docker)](/getting-started/quickstart.md)
- [Requirements](/getting-started/requirements.md)
- [Features](/getting-started/features.md)
- [First-time setup](/getting-started/first-time-setup.md)
- [Single-tenant mode](/getting-started/single-tenant-mode.md)

### Concepts

- [Glossary](/concepts/glossary.md)
- [Apps and resource\_access](/concepts/apps-and-resource-access.md)
- [Realms](/concepts/realms.md)
- [Control Plane / Data Plane](/concepts/control-plane.md)
- [Authentication](/concepts/authentication.md)
- [Authorization (RBAC)](/concepts/groups-and-authorization.md)
- [Permissions & gating](/concepts/permissions.md)
- [Auto-Membership](/concepts/auto-membership.md)
- [ABAC and the IAM boundary](/concepts/abac.md)
- [OAuth 2.0 & OpenID Connect](/concepts/oauth.md)
- [Dynamic Client Registration](/concepts/dynamic-client-registration.md): What DCR is, the MCP use case that makes it relevant again, and how Modgud's "anonymous but triple-gated" stance compares to other IdPs.
- [Sessions & Tokens](/concepts/tokens.md)
- [Security model](/concepts/security-model.md)

### Operate

- [Docker & deployment](/operate/deployment.md)
- [Backend architecture](/operate/backend-architecture.md)
- [Persistence (Marten)](/operate/database.md)
- [Multi-tenancy / Realms](/operate/realms.md)
- [Observability](/operate/observability.md)
- [Recovery CLI](/operate/recovery-cli.md)
- [Key material](/operate/key-material.md)
- [Supply-chain verification](/operate/supply-chain.md)
- [Feature Flags](/operate/feature-flags.md)

### Administer (Realm-Admin)

- [Administration overview](/admin.md)

### Identity & Access

- [Users](/admin/users.md)
- [Service Accounts](/admin/service-accounts.md): Machine identities that authenticate via OAuth client_credentials, sit in the same Group/Role/Permission model as humans, and produce clean audit trails.
- [Positions & shared terminals](/admin/positions.md)
- [Positions & terminals — the concepts](/admin/positions-concepts.md)
- [Roles](/admin/roles.md)
- [Groups](/admin/groups.md)

### OAuth & Federation

- [OAuth Clients](/admin/oauth-clients.md)
- [OAuth Scopes](/admin/oauth-scopes.md)
- [OAuth APIs (Resource Servers)](/admin/oauth-apis.md)
- [Invite Codes](/admin/invite-codes.md)
- [Dynamic Client Registration](/admin/dynamic-client-registration.md)
- [Client ID Metadata Documents (CIMD)](/admin/client-id-metadata-documents.md)
- [Login Providers](/admin/login-providers.md)

### Realm

- [Applications](/admin/applications.md)
- [Realms](/admin/realms.md)
- [Configuration Drafts](/admin/configuration-drafts.md)
- [Declarative Realm Provisioning](/admin/realm-provisioning.md)
- [Realm Settings](/admin/realm-settings.md)
- [Security and platform logs](/admin/auth-log.md)
- [Scheduled Jobs](/admin/scheduled-jobs.md): Tenant-admin surface for the realm's background scheduled jobs — review schedules, tune retention, trigger manually, inspect run history.
- [Change Requests](/admin/change-requests.md)

### Platform

- [Platform](/platform.md): Operator-facing configuration of the Modgud instance.

### Customization

- [Customization — Branding](/platform/branding.md)
- [Customization — Transactional email](/platform/email-customization.md)
- [Customization — Asset Library](/platform/assets.md)
- [Customization — Pages](/platform/pages.md)

### Operations

- [Inbox](/platform/inbox.md): Per-user, in-app notification surface — bell in the header, panel with the live list, server-pushed via SignalR.
- [Inbox settings](/platform/inbox-settings.md): Per-kind retention policy for the inbox — how long items stay around before the daily sweep dismisses or hard-deletes them.
- [Platform Settings](/platform/settings.md)
- [Rate limits](/platform/rate-limits.md)

### Integrate

- [Integrating a Resource Server](/integrate/resource-server.md)
- [SaaS App Integration Walkthrough](/integrate/saas-walkthrough.md)
- [Management API](/integrate/management-api.md): Let a backend or delegated administrator call selected Modgud administration endpoints through OAuth without duplicating Modgud's permission model.
- [Application change feed](/integrate/application-change-feed.md): Bootstrap and continuously synchronize the Modgud entities assigned to one Application through a resumable, app-scoped contract.
- [Secure an MCP server with Modgud (15 minutes)](/integrate/mcp-server.md)
- [Native app integration (iOS / Android / headless)](/integrate/native-apps.md)
- [OAuth / OpenIddict implementation](/integrate/oauth.md)
- [Cookies & sessions](/integrate/cookies-and-sessions.md)
- [Login flows](/integrate/login-flows.md)
- [Login Providers (OIDC and SAML Federation)](/integrate/login-providers.md)
- [Two-Factor Authentication](/integrate/two-factor.md)
- [Position terminals (consumer contract)](/integrate/position-terminals.md)

### User Help

- [End-user help](/end-user.md)
- [First steps](/end-user/first-steps.md)
- [Signing in](/end-user/sign-in.md)
- [Password](/end-user/password.md)
- [Two-factor authentication](/end-user/two-factor.md)
- [Passkey](/end-user/passkey.md)
- [Profile](/end-user/profile.md)

### API Reference

- [OAuth / OIDC Endpoints](/reference/oauth-api.md)
- [Auth Endpoints](/reference/auth-api.md)
- [Admin endpoints](/reference/admin-api.md)
- [Realm Endpoints](/reference/realm-api.md)

### Contribute

- [Developing locally](/contribute/developing-locally.md)
- [Local CI iteration](/contribute/local-ci.md): Running and iterating on GitHub Actions workflows locally with act + workflow_dispatch dry-run.

### Testing

- [Testing](/contribute/testing.md)
- [Automated tests](/contribute/testing/automated-tests.md)
- [Pinned-by-design](/contribute/testing/pinned-by-design.md)
- [Manual smoke checklist](/contribute/testing/manual-checklist.md)

### Architecture decisions

- [Architecture decisions](/decisions.md)
- [OAuth / MCP client registration: DCR (public + confidential) now, CIMD next](/decisions/0001-oauth-mcp-client-registration.md)
- [Public origin is derived, not configured (per-realm host, request-derived issuer, fail-closed proxy trust)](/decisions/0002-public-origin-derived.md)
- [Persistence: hybrid event-sourcing + flat documents, best-fit per feature](/decisions/0003-persistence-hybrid-event-sourcing-and-documents.md)
- [Tenancy: database-per-realm, master/system split](/decisions/0004-tenancy-database-per-realm.md)
- [Permission model: per-app catalog, RBAC via groups, two bypass tiers](/decisions/0005-permission-model-catalog-rbac.md)
- [Identity Hub, not Federation Proxy](/decisions/0006-identity-hub-not-federation-proxy.md)
- [Access tokens: reference by default, per-client JWT opt-in, signed-not-encrypted](/decisions/0007-access-token-format.md)
- [CIMD (Client ID Metadata Documents): authorization-server design](/decisions/0008-cimd-client-id-metadata-documents.md)
- [Per-client WebAuthn RP-ID: decouple relying-party identity from the tenant domain](/decisions/0009-per-client-webauthn-rp-id.md)
- [Native cookieless authentication: token-minting custom grants at the token endpoint (passkey, OTP, magic-link)](/decisions/0010-native-cookieless-token-grants.md)
- [Application tier: origin & login-experience as a soft facet within a tenant (users + keys stay at the tenant)](/decisions/0011-application-tier-origin-facet.md)
- [Invite-code-gated passwordless self-registration (a fourth SelfRegPosture)](/decisions/0012-invite-code-self-registration.md)
- [PageBuilder: named page variants and activation at realm and application level](/decisions/0013-pagebuilder-page-variants.md)
- [Finish the customization core before the page builder](/decisions/0014-customization-core-before-page-builder.md)
- [Positions, terminals and staffing are the shared-device model — no parallel concepts](/decisions/0015-positions-terminals-staffing-shared-device-model.md)
- [Policy, binding and control-plane semantics for positions, terminals and staffing](/decisions/0016-position-policy-binding-control-plane.md)
- [Staged configuration (draft mode) on the manifest engine, with transactional apply](/decisions/0017-staged-configuration-draft-mode.md)
- [Registration before proof: one pending-registration pipeline for every sign-up path](/decisions/0018-registration-before-proof.md)
- [Caller context and multi-dimensional rate limiting for public auth endpoints](/decisions/0019-caller-context-and-rate-limiting.md)
- [Device-aware login throttling: trusted-device buckets instead of IP limits or global lockout](/decisions/0020-device-aware-login-throttling.md)
- [Back-channel logout: server-initiated logout propagation to relying parties](/decisions/0021-back-channel-logout.md)
- [Two-instance operation: one Wolverine-coordinated cluster, Postgres backplane, N-1 release rule](/decisions/0022-two-instance-operation.md)
- [The public origin is declared, not derived](/decisions/0023-public-origin-is-declared.md)

### Other

- [API Reference](/reference.md): HTTP endpoint reference for the OAuth/OIDC surface, the authentication API, the admin API, and the realm-management API.
- [Audit storage ownership decision](/contribute/audit-storage-decision.md)
- [Concepts](/concepts.md): How Modgud thinks about identity, tenancy, authorization, and the OAuth/OIDC surface — the mental model behind the code.
- [Contribute](/contribute.md): Developing locally, the test suite layout, what gets pinned by tests vs left flexible.
- [Integrate](/integrate.md): Hooking your app up to Modgud — as an OAuth client, as a resource server protecting an API, or via cookie sessions for an internal SPA.
- [Operate](/operate.md): Running Modgud in production — Docker deployment, persistence, multi-tenancy provisioning, observability, recovery procedures.
- [Roadmap](/roadmap.md): What Modgud ships today and what's coming next.
- [SAML 2.0 federation](/admin/saml-federation.md)