Citadel
Sign in

Identity provider

One sign-in for every application in a space.

Citadel signs people in - passwords, magic links, passkeys, Google and enterprise SSO - and hands applications a standard OpenID Connect identity. Each space keeps its own users, providers and clients on its own subdomain.

<space>.citadel.g.combine.mesa.ws /.well-known/openid-configuration
Operator sign in
Spaces
One per application group. Users, providers, clients and sessions never cross a space boundary.
Single sign-on
A session on the space host signs users in to every registered application without a second login.
Bring your providers
Password, magic link, one-time code, TOTP, passkeys, Google, Apple and any OIDC connection - per space.
Standard OIDC
Authorization code with PKCE, refresh tokens, userinfo, JWKS, revocation and logout for relying parties.