Open source · OpenResty · Lua · PostgreSQL
One API for sign-in, tenants and business modules
OpsAPI is a self-hosted, multi-tenant API platform. It signs your users in once for every app, keeps each customer's data in its own workspace, and switches on the business modules a product needs, from CRM to UK tax filing.
- Lua in Nginx workers
- 20 business modules
- 16 presets
- Helm chart
- TypeScript SDK
# bring up API, dashboard, Postgres and friends
$ ./start.sh -e local -n -j all
# is it up?
$ curl -s localhost:4010/health
{ "status": "healthy", … }
# browse every endpoint
$ open localhost:4010/swaggerWhat it does
Four things every product rebuilds, done once
One sign-in for every app
Passwords with emailed codes, Google and Apple, SAML single sign-on per workspace, a hosted sign-in page and tokens your apps check with one call.
Learn more →Workspaces from the first table
Every business row carries its workspace. Roles are module.action permissions per workspace.
Learn more →20 business modules, switched per deployment
CRM, invoicing, accounting, UK tax filing, e-commerce, care, field service and more. Load only what a product uses.
Learn more →Built to be run
One container, a Helm chart, secrets from a vault, health checks, Prometheus metrics and an error catalog with correlation ids.
Learn more →How it fits
Every client, one API, only the modules you need
Live demo
Click around a real deployment
Sign in to the full admin dashboard, with every app and sample data, using a read-only demo login or SAML single sign-on, then log in to five apps in Java, PHP, Python, Rust and Go that share one OpsAPI sign-in.
Technotes
For developers, DevOps and SRE
SAML single sign-on per workspace
Each workspace connects its own SAML 2.0 identity provider. How the sign-in round trip works, what OpsAPI checks in every response, and why an IdP can only vouch for its own workspace.
Keeping admin dashboards off the internet: VPN and zero-trust access
Customer apps are public; the dashboards that run the platform shouldn’t be. How to put OpsAPI admin, the edge admin, the vault UI, Grafana and the Kubernetes API behind a VPN or ZTNA broker, with OpsAPI sign-in and roles still on top.
Webhooks: sending workspace events to your own systems
How OpsAPI turns business changes into signed HTTP deliveries, how retries and ordering work, how to verify a request, and how the CMS “website update” webhook refreshes a static site.
Single sign-on for any app: the OpsAPI sign-in flow
How a Java app and a PHP app share one sign-in through OpsAPI: the hosted sign-in page, the nonce, the token hand-back and the one call that proves who the user is.
One request through OpsAPI: from nginx worker to PostgreSQL
What happens between a request arriving and the JSON going back: the global before_filter, the public allow-list, JWT and API-key checks, feature-gated routes, the middleware chain, the routes → queries → models layering and the two response envelopes.
Building a safe public demo login
Publishing a password for a real admin dashboard without leaking anyone's data or letting visitors break it: a separate workspace, a read-only role and a reset job.
Blog
For the people who choose the stack
One API, many modules: why we stopped building a backend per product
A separate backend for every product means separate logins, user tables and security fixes. OpsAPI keeps one multi-tenant core and switches business modules on per deployment.
One sign-in for every app, run on our own cluster
Two demo apps in two languages share one self-hosted sign-in. What that changes for a team that keeps adding apps, and where admin access belongs.
Read the code
OpsAPI is open source. Run it from Docker Hub, or clone it and bring the whole stack up with one script.