Orionis

Service-to-service identity for Go

Service identity.
Made simple.

Give every service a clear identity. Issue signed access tokens, grant precise permissions, and verify requests locally with a compact Go toolkit.

Get started Explore the API
v0.6.0OAuth 2.0Ed25519 by default
01 / The trust modelclient_credentials
How orders-service calls billing-api Orders requests a token from Orionis and receives a signed JWT. Orders sends that token directly to billing. Billing separately fetches public keys from Orionis when needed and validates the token locally. AUTHORIZATION SERVER orionis-auth CALLING SERVICE orders-service RESOURCE SERVICE billing-api 1. Request a token 2. Signed JWT 3. API call Bearer JWT 4. JWKS on demand ✓ Verify locally
  1. 01 / Orders → OrionisRequest a token with client credentials.
  2. 02 / Orionis → OrdersReturn a signed, audience-bound JWT.
  3. 03 / Orders → BillingCall the API with the Bearer token.
  4. 04 / Billing ↔ Orionis · when neededFetch public keys through JWKS, cache them, then verify locally.
The API request goes straight to billing. Public keys travel separately and are cached; a fresh matching key makes verification entirely local.
One identity per callerKnow which service is making the request.
Permissions with boundariesChoose the target API and allowed actions.
Local JWT verificationKeep routine checks inside your service.
01

Three roles. One clear trust model.

Orionis implements OAuth 2.0 client credentials: a service proves its own identity to call another service.

CALLER

Ask for access.

The orders service authenticates with its client ID and secret. It requests a token for billing and the actions it needs.

AUTHORIZATION SERVER

Grant and sign.

Orionis checks the caller’s grants, signs a short-lived JWT, and publishes the corresponding public keys through JWKS.

RESOURCE SERVICE

Verify and serve.

Billing checks the signature, issuer, audience, time claims, token use, and route permissions before running the handler.

Caller
The service making a request, identified by its client ID.
Audience
The API a token is intended for, such as billing-api.
Scope
A permission, such as billing.invoice.create.
JWT
A signed token carrying the service identity, target, permissions, and expiry.
JWKS
The public key set used to check token signatures.
GIN guard
Middleware that verifies tokens and enforces route scopes.
02

Your first authorized request.

Run the included orders → billing example in three terminals. The caller obtains and attaches the token for you.

Start with the source.

Use Go 1.26 or newer. Clone the repository, then run each command from its root directory.

Set up the example
git clone https://github.com/stremovskyy/orionis.git
cd orionis
git checkout v0.6.0

Prefer containers? Use the Docker and Compose guide. Java and PHP callers are also included in the examples directory.

TERMINAL 01Start Orionis

Shell · authorization server 
go run ./cmd/orionis-auth -config ./config/orionis.example.yaml

TERMINAL 02Start the protected API

Shell · billing API
go run ./examples/gin-billing-service

TERMINAL 03Make the request

Shell · orders caller 
go run ./examples/gin-orders-client

status=201Invoice created by orders-service.

03

Build it into your services.

Readable builders, small interfaces, and a deployment model you can follow.

01 / INTEGRATE

A few readable chains.

Request tokens, add an authenticated HTTP client, and protect your GIN routes.

Read the API guide ↗02 / DEPLOY

From local to production.

Run a pinned container or deploy to ECS with AppConfig and injected signing keys.

Open the deployment guide ↗03 / OPERATE

Keep the boundaries clear.

Understand secrets, permissions, token lifetimes, and overlapping key rotation.

Explore the security model ↗