Self-hosted Managed

The identity platform you can host yourself.

Central login, enterprise SSO, directory sync, RBAC, billing-driven entitlements and a tamper-evident audit trail. Run the open-source edition on your own infrastructure, or let us host it.

Read the documentation →

Illustrative interface

Self-hosted

Run it on your own infrastructure

The admin console app, built on the laravel-id framework.

View on GitHub → Documentation →

Managed

Or let us host it

Hosted Cbox ID with SSO, SCIM and audit managed for you. Early access.

Own your identity layer

Self-host the whole platform. Your users, secrets and audit trail never leave your own infrastructure.

Bind, don't fork

Every capability is a contract you implement, mock or swap. No forking, no framework lock-in.

Compliance-ready

OAuth, OIDC, SCIM and SAML with control mappings to SOC 2, ISO 27001, GDPR, HIPAA and PCI-DSS.

Everything an identity layer is expected to do

Authentication & SSO

Central login plus enterprise single sign-on over SAML and OIDC, and an OAuth/OIDC provider of your own so other apps log in against you.

Directory sync (SCIM)

SCIM 2.0 provisioning so an upstream IdP creates, updates and deactivates users and groups automatically.

RBAC, deny-by-default

Role-based access control with an authorization kernel where every check is explicit rather than assumed.

Billing-fed entitlements

What a user or organization can do follows their plan, without hand-wired feature flags.

Tamper-evident audit

A cryptographically-backed audit trail you can query and prove, for the who-did-what a compliance review will ask for.

Standards & compliance

OAuth, OIDC, SCIM, SAML, FAPI and MCP, with control mappings to SOC 2, ISO 27001, NIS2, GDPR, HIPAA and PCI-DSS.

Consuming Cbox ID tokens from your own services? The cbox-id-jwks-auth and cbox-id-tokens libraries (PHP and Go) validate JWKS-only tokens and handle service-to-service OAuth, so resource servers verify tokens without calling home.