Skip to main content
Start Free Trial

Start Here

Guardhouse is an OAuth 2.0 and OpenID Connect identity service. Each Guardhouse tenant provides:

  • a hosted sign-in experience for people using your applications
  • an authorization server that issues access, ID, and refresh tokens
  • an administration dashboard for clients, API resources, scopes, users, roles, and permissions
  • a privileged System API for automating user, role, and permission management

Your application redirects users to Guardhouse to sign in or authenticates as a backend service. Your API then validates the access token before accepting the request.

Choose Your Integration​

I want to...Start with
Add sign-in to a React applicationReact sign-in quickstart
Protect an ASP.NET Core API.NET API quickstart
Protect an Express APINode.js API quickstart
Authenticate a backend, job, agent, or MCP serverMachine-to-machine quickstart
Choose between JWT validation and introspectionProtect an API
Automate users, roles, and permissionsUse the System API

Before You Begin​

You need a Guardhouse tenant and access to its administration dashboard. Keep these values nearby:

Issuer URL: https://your-tenant.guardhouse.cloud
Client ID:   created in the Guardhouse dashboard
Audience:    the identifier of the API resource receiving the token

A browser application is a public client and must not have a client secret. A backend or service client can keep a secret and may use the client credentials flow.

Your issuer publishes OpenID Connect metadata. Use it as the source of truth for endpoint and signing-key locations:

curl "https://your-tenant.guardhouse.cloud/.well-known/openid-configuration"

The Four Objects to Configure​

  1. A client represents the application or service asking Guardhouse for tokens.
  2. An API resource represents the API that will accept an access token. Its identifier is the token audience expected by that API.
  3. A scope describes access that a client can request for an API resource.
  4. A user or service identity is the subject represented by the resulting token.

Read Clients, resources, and scopes before configuring a production integration.

How a Request Travels​

Application or service
        |
        | authorize or request a token
        v
Guardhouse tenant
        |
        | access token
        v
Your API resource
        |
        | validate issuer, audience, lifetime, signature/state, and access
        v
Protected operation

Authentication proves who the caller is. Your API is still responsible for authorization: checking the scopes, roles, permissions, or policies required by each operation.

Learn the Model​

Keep secrets on the server

A client secret and a System API token are credentials. Never put them in React code, another browser bundle, a mobile application, a public repository, or logs.