P'adentro is one self-hosted authentication service every API on your stack delegates to. This page covers the core concepts; the full request/response reference is generated straight from the API's own OpenAPI spec.
Your API registers as a tenant once, with a scoped set of permissions. Every user, session, and token P'adentro issues is namespaced to a tenant.
Fine-grained permissions attached to a tenant: read/write on users, read/write on memberships. A tenant only ever gets the access it needs.
Short-lived, signed access tokens your API verifies locally against P'adentro's public key: nothing to leak or replay, no session store to keep in sync.
No cookies. No tracking. Beta data handled under GDPR/RTBF.