An open-source OAuth2 and OIDC server: complete enough for a real application, small enough that you can read the authorization endpoint and know what it does. PKCE, refresh rotation, introspection, revocation, pushed authorization requests, passwordless flows, and a full consent UI.

The self-hosted identity servers are either enormous or abandoned. Luma is an attempt at the third option: complete enough to put in front of a real application, small enough that you can read the authorization endpoint and know what it does.

What it implements

• Authorization code flow with PKCE, refresh rotation, introspection (RFC 7662), revocation (RFC 7009), and pushed authorization requests (RFC 9126).
• Passwordless flows via magic links and numeric codes, with dual JWT and opaque access tokens.
• A full Razor consent UI, rather than leaving consent as an exercise for the integrator.

What was interesting

Most of the difficulty in an authorization server is not the happy path. It is deciding, for every spec-optional behaviour, whether the safe default or the convenient one wins, and then being consistent about it across a dozen endpoints that were written weeks apart.