# FoxAuth > Source-available OAuth 2.1 and OpenID Connect authorization server, built on OAuth-server.ts. Self-hosted or cloud-managed, with an admin console and an MCP control plane an AI agent can drive. ## Start here - [FoxAuth — the authorization server for the agent era](https://foxauth.dev/): A source-available OAuth 2.1 and OpenID Connect server you run yourself, with a built-in admin console and administration over MCP for AI agents. - [Run with Docker Compose](https://foxauth.dev/docs/get-started/docker-compose/): Start MongoDB, provision the schema and serve the authorization server with one command. - [Create the first administrator](https://foxauth.dev/docs/get-started/first-admin/): The one-time setup screen, how administrator sign-in works, and the second factor to turn on before anything else. - [Register your first client](https://foxauth.dev/docs/get-started/first-client/): Groups, projects and clients in the console, public versus confidential, and how a client decides which users it signs in. - [Get your first token](https://foxauth.dev/docs/get-started/first-token/): An Authorization Code plus PKCE walk-through with curl, from the challenge to a decoded ID token and a UserInfo call. - [Run from source](https://foxauth.dev/docs/get-started/from-source/): Clone the repository, provision the database and start the server with Bun. - [Protect your MCP server with OAuth](https://foxauth.dev/docs/get-started/protect-your-mcp-server/): Make your MCP server an OAuth 2.1 protected resource in ten minutes. Declare it here, publish its metadata, validate a token, and prove both outcomes. ## Product - [Contact](https://foxauth.dev/contact/): Reach the FoxAuth team: general enquiries at hello@foxauth.dev, vulnerability reports at security@foxauth.dev, and bugs on GitHub. - [Features](https://foxauth.dev/features/): Every grant, profile and control OAuth-server.ts implements: OAuth 2.1 with PKCE, DPoP, PAR, FAPI, CIBA and mTLS, an audited console, and OAuth for MCP servers. - [Pricing](https://foxauth.dev/pricing/): Self-hosting FoxAuth is free and complete. A managed cloud instance is planned, and an enterprise support contract is available for self-hosted deployments. ## Compare - [Compare](https://foxauth.dev/compare/): How FoxAuth compares with Keycloak and Auth0 on hosting, protocol coverage, administration and licensing, dated and sourced from their own documentation. - [FoxAuth compared with Auth0](https://foxauth.dev/compare/auth0/): Auth0 is a managed identity service billed per monthly active user. FoxAuth is a server you run, with every protocol feature included. - [FoxAuth compared with authentik](https://foxauth.dev/compare/authentik/): authentik is a self-hosted identity provider covering SAML, LDAP and RADIUS as well as OIDC. FoxAuth does OAuth 2.1 only, with the banking-grade profiles. - [FoxAuth compared with Keycloak](https://foxauth.dev/compare/keycloak/): Both are servers you run yourself. They differ in runtime, storage, scope and how much of the protocol is on by default. - [FoxAuth compared with Ory Hydra](https://foxauth.dev/compare/ory-hydra/): Ory Hydra is an OAuth 2.0 and OpenID Connect server that delegates login to an app you write. FoxAuth ships the login, consent and admin surfaces with it. - [FoxAuth compared with Zitadel](https://foxauth.dev/compare/zitadel/): Zitadel is a multi-tenant identity platform with SAML, SCIM and a managed cloud. FoxAuth is a smaller OAuth 2.1 server with the banking-grade profiles built in. ## Blog - [OAuth in practice](https://foxauth.dev/blog/): Notes on OAuth 2.1, OpenID Connect and running your own authorization server, written by the team building FoxAuth as we hit things worth writing down. - [What DPoP protects you from, and what it doesn't](https://foxauth.dev/blog/what-dpop-protects-you-from/): A leaked access token is a password for whoever finds it. DPoP binds it to a key the client keeps: what that buys, what it costs, and when I would not bother. ## Documentation - [Documentation](https://foxauth.dev/docs/): How to run, integrate and administer OAuth-server.ts, the engine behind FoxAuth, from a first container to a production deployment. - [Deploy with Docker Compose](https://foxauth.dev/docs/deploy/docker-compose/): A production-leaning Compose file, with pinned tags, a database you back up, and a TLS proxy in front. - [Deploy to Fly.io](https://foxauth.dev/docs/deploy/fly/): The shipped fly.toml, why the release command provisions the database, and which values are secrets. - [Deploy on Kubernetes](https://foxauth.dev/docs/deploy/kubernetes/): A Deployment, a Service, a provisioning Job that must finish first, and a caveat about scaling replicas. - [MongoDB Atlas](https://foxauth.dev/docs/deploy/mongodb-atlas/): The connection string, where the database name goes, network access, and what provisioning creates. - [PostgreSQL](https://foxauth.dev/docs/deploy/postgresql/): Choosing PostgreSQL instead of MongoDB, which variable selects it, how to provision the schema, and the migration step each upgrade needs. - [Behind a reverse proxy](https://foxauth.dev/docs/deploy/reverse-proxy/): Where TLS terminates, the setting with a wrong answer in each direction, and nginx and Caddy blocks that work. - [Upgrading](https://foxauth.dev/docs/deploy/upgrade/): Read the changelog, move the tag, re-run db:setup, apply migrations and restart. Five steps, and what each one is actually for. - [Security assurance](https://foxauth.dev/docs/security/assurance/): What backs the security claims, from the scanning that runs on every push and every week to where each result is published, and what has not been done yet. - [Threat model for OAuth-server.ts](https://foxauth.dev/docs/security/threat-model/): The assets, trust boundaries and attackers this authorization server is built against, and for each threat the control in the code and the test that holds it. ## Reference - [Addon seams](https://foxauth.dev/docs/reference/addon-seams/): The behaviour functions a deployment may replace at call time through the override registry. - [Admin API](https://foxauth.dev/docs/reference/admin-api/): The management API behind the console and the MCP control plane: reads, audited mutations and console-only operations. - [Endpoints](https://foxauth.dev/docs/reference/endpoints/): Every protocol endpoint with the flag that serves it, its CORS class and its rate-limit class. - [Environment variables](https://foxauth.dev/docs/reference/environment/): The only process environment the server reads. Everything else is a setting in the database. - [MCP tools](https://foxauth.dev/docs/reference/mcp-tools/): Every tool the administrative MCP control plane publishes, with its consequence class and input schema. - [Settings](https://foxauth.dev/docs/reference/settings/): Every server setting, grouped the way the console groups them, with its default and the flag it depends on. ## Project - [Changelog — every release of OAuth-server.ts](https://foxauth.dev/changelog/): Notable changes to OAuth-server.ts, release by release: new grants and protocol support, breaking changes, security fixes, and the version each shipped in. - [License — FSL-1.1-ALv2, and what you may do](https://foxauth.dev/license/): OAuth-server.ts is source-available under the Functional Source License 1.1, with Apache 2.0 as its future license. What that permits, and what it does not. - [Security policy](https://foxauth.dev/security/): Where to send a vulnerability report for OAuth-server.ts, what to include, how quickly we acknowledge and fix it, and what is in and out of scope. ## Full text - [Complete site](https://foxauth.dev/llms-full.txt): every page above, in full. - [Abridged documentation](https://foxauth.dev/llms-small.txt): the documentation with non-essential content removed. Every page is also available on its own as Markdown, at the page address plus `.md` — for example https://foxauth.dev/features.md.